- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - disable building BOX2D_BUILD_UNIT_TESTS due to "SIGSTKSZ ... no longer constant on Linux ... redefined to sysconf(_SC_SIGSTKSZ)" https://github.com/bminor/glibc/blob/master/NEWS causing build failure - reduce unnecessary dependencies - Use make macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.4.1 - 2.4.0 with patch for cmake shared libs. - Fix FTBFS. - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream version - New upstream version - New upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Initial package version - Fix CVE-2026-51235 Resolves: RHEL-219221 - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165374, RHEL-165461 - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165373, RHEL-165456 - Fix CVE-2026-51235 Resolves: RHEL-219221 - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165374, RHEL-165461 - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165373, RHEL-165456 - Fix CVE-2026-51235 Resolves: RHEL-219221 - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165374, RHEL-165461 - Fix CVE-2026-21413 and CVE-2026-24450 Resolves: RHEL-165373, RHEL-165456 - Update to 1.20.2 - Rebuild to update libqmi's libqrtr support (rh #2032807) - Include libqrtr-glib build dependency (rh #1996716) - Upgrade to 1.18.2 - Update to 1.18.0 - depend ModemManager on polkit package (rh #1995186) - enable polkit support to allow normal users to access modems (rh #1995186) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.0.36 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.8.3 Resolves: rhbz#1742557 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 2.8.1 - Backport fix for CVE-2026-41651. - Resolves: #RHEL-170504 - Initial package Resolves: bz#2081238 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.0 - Resolves: RHEL-85839 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.16.0 - Related: RHEL-80816 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.15.0 - Related: RHEL-80816 - fix dep issues in tests subpackage - Resolves: RHEL-80816 - rebuilt to try TMT tests in osci - Resolves: RHEL-80816 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.14.0 - Related: RHEL-60277 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.13.1 - Related: RHEL-60277 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.1 - Resolves: RHEL-170152 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.0 - Resolves: RHEL-85839 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.16.0 - Related: RHEL-80816 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.15.0 - Related: RHEL-80816 - fix dep issues in tests subpackage - Resolves: RHEL-80816 - rebuilt to try TMT tests in osci - Resolves: RHEL-80816 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.14.0 - Related: RHEL-60277 - update to https://github.com/containers/aardvark-dns/releases/tag/v1.13.1 - Related: RHEL-60277 - Fix issue with restoring SELinux file label Resolves: RHEL-134944 - Add explicit selinux dependencies to avoid policycoreutils-python-utils dependency Resolves: RHEL-134944 - Rebase to latest upstream version Resolves: RHEL-134944 Resolves: RHEL-134945 Resolves: RHEL-134946 Resolves: RHEL-134947 Resolves: RHEL-134948 Resolves: RHEL-134950 Resolves: RHEL-134951 Resolves: RHEL-134952 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - remove mention of Fedora from desc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - remove mention of Fedora from desc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Make package noarch - Add rsadgstsign support - Only install rpm-sign on s390x and ppc64le - Initial package - Update to v2025.12.2 - Update to v2025.05 - Add sof-ipc4-lib directory - Update to v2024.09.2 - Update to v2024.09.1 - Update to v2024.09 - Update to v2024.03 - Add AVS topology files v2024.02 - update to alsa-lib 1.2.15.3 and alsa-ucm-conf 1.2.15.3 - update to alsa-lib 1.2.14 and alsa-ucm-conf 1.2.14 - update to alsa-lib 1.2.13 and alsa-ucm-conf 1.2.13 - update to alsa-lib 1.2.12 and alsa-ucm-conf 1.2.12 * Updated to 1.2.15.2 * Updated to 1.2.14 * Updated to 1.2.13 * Updated to 1.2.12 * Updated to 1.2.15.2 * Updated to 1.2.14 * Updated to 1.2.13 * Updated to 1.2.12 * Updated to 1.2.15.2 * Updated to 1.2.14 * Updated to 1.2.13 * Updated to 1.2.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Skip running ImageIOTest test - Rebuild to fix incorrect version string - Resolves: rhbz#1936159 - Fix integer overflow when parsing SOURCE_DATE_EPOCH - Fix FTBFS with JUnit 5.8.x - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.10.12 - Bump release - Add Obsoletes for removed apache-log4j subpackage to fix upgrades - Import from Fedora - Drop Obsoletes on ant-javamail - Exclude several subpackages from unbound test plan - Fix ant-manual license field - Use smaller jlink image - Require /plans/matrix/unbound/jlink for gating - Add test plan for ant-unbound - Exclude ant-unbound from openjdk21 tests - Drop explicit requires on javapackages-tools - Generate bindings with %jp_binding macro - Implement new Java bindings and fix ant-manual license - Resolves: RHEL-68742, RHEL-68743, RHEL-68744, RHEL-68745, RHEL-69519 - Fix test declarations - Add noarch to ExclusiveArch - Disable building on i686 - Fix the usage ot patch macro - Add OpenJDK bindings in a separate configuration file - Resolves: RHEL-62405 - Add OpenJDK bindings - Resolves: RHEL-62405 - Fix test failures due to JPEG CMYK support in OpenJDK - Resolves: RHEL-5354 - Implement new Java bindings and fix ant-manual license - Resolves: RHEL-68742, RHEL-68743, RHEL-68744, RHEL-68745, RHEL-69519 - Fix test declarations - Add noarch to ExclusiveArch - Disable building on i686 - Fix the usage ot patch macro - Add OpenJDK bindings in a separate configuration file - Resolves: RHEL-62405 - Add OpenJDK bindings - Resolves: RHEL-62405 - Fix test failures due to JPEG CMYK support in OpenJDK - Resolves: RHEL-5354 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Skip running ImageIOTest test - Rebuild to fix incorrect version string - Resolves: rhbz#1936159 - Fix integer overflow when parsing SOURCE_DATE_EPOCH - Fix FTBFS with JUnit 5.8.x - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.10.12 - Bump release - Add Obsoletes for removed apache-log4j subpackage to fix upgrades - Import from Fedora - Drop Obsoletes on ant-javamail - Exclude several subpackages from unbound test plan - Fix ant-manual license field - Use smaller jlink image - Require /plans/matrix/unbound/jlink for gating - Add test plan for ant-unbound - Exclude ant-unbound from openjdk21 tests - Drop explicit requires on javapackages-tools - Generate bindings with %jp_binding macro - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Skip running ImageIOTest test - Rebuild to fix incorrect version string - Resolves: rhbz#1936159 - Fix integer overflow when parsing SOURCE_DATE_EPOCH - Fix FTBFS with JUnit 5.8.x - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.10.12 - Bump release - Add Obsoletes for removed apache-log4j subpackage to fix upgrades - Import from Fedora - Drop Obsoletes on ant-javamail - Exclude several subpackages from unbound test plan - Fix ant-manual license field - Use smaller jlink image - Require /plans/matrix/unbound/jlink for gating - Add test plan for ant-unbound - Exclude ant-unbound from openjdk21 tests - Drop explicit requires on javapackages-tools - Generate bindings with %jp_binding macro - Import from Fedora - Drop Obsoletes on ant-javamail - Exclude several subpackages from unbound test plan - Fix ant-manual license field - Use smaller jlink image - Require /plans/matrix/unbound/jlink for gating - Add test plan for ant-unbound - Exclude ant-unbound from openjdk21 tests - Drop explicit requires on javapackages-tools - Generate bindings with %jp_binding macro - Import from Fedora - Drop Obsoletes on ant-javamail - Exclude several subpackages from unbound test plan - Fix ant-manual license field - Use smaller jlink image - Require /plans/matrix/unbound/jlink for gating - Add test plan for ant-unbound - Exclude ant-unbound from openjdk21 tests - Drop explicit requires on javapackages-tools - Generate bindings with %jp_binding macro - set javac source / target version to 1.8 to fix issues with Java 11 - Rebuild - Rebuild - Fix patch usage - Rebuild with regenerated Requires on Java - set javac source / target version to 1.8 to fix issues with Java 11 - Rebuild - Rebuild - Fix patch usage - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Fix improper access control vulnerability - Resolves: CVE-2025-48734 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Update to upstream version 1.9.0 - Resolves: rhbz#2305042 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.8.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.6.0 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Use %autosetup -C - Update to upstream version 1.9.0 - Resolves: rhbz#2305042 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.8.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.6.0 - Update javapackages test plan to f42 - Use %autosetup -C - Update to upstream version 1.9.0 - Resolves: rhbz#2305042 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.8.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.15 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.17.1 - Update to upstream version 1.16.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.15 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.17.1 - Update to upstream version 1.16.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.17.1 - Update to upstream version 1.16.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Backport fix to build with maven-antrun-plugin 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Backport fix to build with maven-antrun-plugin 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuild to verify xmvn/maven switch to jakarta-annotations. - Fix ambiguous reference in AbstractTestCollection to build on Java 11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Backport fix to build with maven-antrun-plugin 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Backport fix to build with maven-antrun-plugin 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuild to verify xmvn/maven switch to jakarta-annotations. - Fix ambiguous reference in AbstractTestCollection to build on Java 11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Backport fix to build with maven-antrun-plugin 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Update to upstream version 1.27.1 - Resolves: rhbz#2283072 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.25.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add missing BuildRequires - Update to upstream version 1.21 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Ensure Java 8 level bytecode when built on Java 11 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Update to upstream version 1.27.1 - Resolves: rhbz#2283072 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.25.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Add patch to fix Files.size() failing when symlink target is non-existant - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 2.8.0. - Update to upstream version 2.8.0 - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.16.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Add patch to fix Files.size() failing when symlink target is non-existant - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 2.8.0. - Update to upstream version 2.8.0 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.0 - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.16.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.16.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Set javac -source and -target to 1.8. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Set javac -source and -target to 1.8. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Workaround build issue with RPM 4.18 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 3.11. - Fixes RHBZ#1699692 - Update to upstream version 3.11 - Update javapackages test plan to f42 - Update to upstream version 3.17.0 - Resolves: rhbz#2309016 - Use %autosetup -C - Update to upstream version 3.16.0 - Resolves: rhbz#2298535 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.14.0 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Workaround build issue with RPM 4.18 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 3.11. - Fixes RHBZ#1699692 - Update to upstream version 3.11 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Workaround build issue with RPM 4.18 - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Update to upstream version 3.17.0 - Resolves: rhbz#2309016 - Use %autosetup -C - Update to upstream version 3.16.0 - Resolves: rhbz#2298535 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.14.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build against log4j 2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use %autosetup -C - In bootstrap mode build with log4j - Update to upstream version 1.3.4 - Resolves: rhbz#2271286 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build against log4j 2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Use %autosetup -C - In bootstrap mode build with log4j - Update to upstream version 1.3.4 - Resolves: rhbz#2271286 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.3.0 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 52. - Update to upstream version 52 - Update to upstream version 51 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 53 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 52. - Update to upstream version 52 - Update to upstream version 51 - Update javapackages test plan to f42 - Update to upstream version 73 - Resolves: rhbz#2300082 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 71 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 66 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable moditect-maven-plugin - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 23. - Update to upstream version 23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Workaround build issue with RPM 4.18 - Update to upstream version 26 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 33 - Resolves: rhbz#2296782 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 31 - Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Port to maven-verifier 2.0.0~M1 - Update to upstream version 1.5 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 30 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 36 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to version 1.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.1.2 - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 1.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to version 1.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.1.2 - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 1.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 6.2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Enable biz.aQute.bnd.ant - Rename maven_plugin build conditional to bnd_maven_plugin - reenable bnd-maven-plugin - Add parent to biz.aQute.bnd/pom.xml (fixes [WARNING] JAR will be empty - no content was marked for inclusion!) - Remove scope from dependencies in pom.xml files (fixes missing dependencies, dependencies marked with scope provided are ignored by the rpm dependency generator) - Drop some more commands: shell, exportreport, mbr (uses parts that are not packaged) - Resolves: rhbz#1985566 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Drop explicit requires on javapackages-tools - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionally disable bnd-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add requires on java-devel - Add parent to biz.aQute.bnd/pom.xml (fixes [WARNING] JAR will be empty - no content was marked for inclusion!) - Remove scope from dependencies in pom.xml files (fixes missing dependencies, dependencies marked with scope provided are ignored by the rpm dependency generator) - Drop some more commands: shell, exportreport, mbr (uses parts that are not packaged) - Resolves: rhbz#2033709 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 5.2.0 - Update jansi path for jansi 1.x and jline path for jline 2.x - Add OSGi metadata - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 6.2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Enable biz.aQute.bnd.ant - Rename maven_plugin build conditional to bnd_maven_plugin - reenable bnd-maven-plugin - Add parent to biz.aQute.bnd/pom.xml (fixes [WARNING] JAR will be empty - no content was marked for inclusion!) - Remove scope from dependencies in pom.xml files (fixes missing dependencies, dependencies marked with scope provided are ignored by the rpm dependency generator) - Drop some more commands: shell, exportreport, mbr (uses parts that are not packaged) - Resolves: rhbz#1985566 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Drop explicit requires on javapackages-tools - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionally disable bnd-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 6.2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Enable biz.aQute.bnd.ant - Rename maven_plugin build conditional to bnd_maven_plugin - reenable bnd-maven-plugin - Add parent to biz.aQute.bnd/pom.xml (fixes [WARNING] JAR will be empty - no content was marked for inclusion!) - Remove scope from dependencies in pom.xml files (fixes missing dependencies, dependencies marked with scope provided are ignored by the rpm dependency generator) - Drop some more commands: shell, exportreport, mbr (uses parts that are not packaged) - Resolves: rhbz#1985566 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Drop explicit requires on javapackages-tools - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionally disable bnd-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new release to fix testsuite against Python 3.9 - new release - new release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - update source url - new upstream release 9.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - remove asciidoc-music sub-package (lilypond requirement) - remove ImageMagic requirement - Add patch to fix problem with not respecting newline configuration. - Remove unused patches. - Detection of latest Python releases (#1889725) - Update to latest upstream release 9.0.4 - Remove patches - Remove Vim support - Update to latest upstream release 9.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild * Bump to 1.16.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.19.0 - Update to upstream version 3.18.1 - Update to version 3.17.2. - Update to upstream version 3.17.2 - Update javapackages test plan to f42 - Update to upstream version 3.26.3 - Don't install CONTRIBUTING.md in javadoc package - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove dependency on junit5-bom - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.19.0 - Update to upstream version 3.18.1 - Update to version 3.17.2. - Update to upstream version 3.17.2 - Do not install CONTRIBUTING.md in javadoc package - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Fix CVE-2026-24400: prevent XXE attacks in XmlStringPrettyFormatter - Resolves: RHEL-183484 - Do not install CONTRIBUTING.md in javadoc package - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Update to upstream version 3.26.3 - Don't install CONTRIBUTING.md in javadoc package - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove dependency on junit5-bom - Sync with Fedora - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.0.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Sync with Fedora - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Sync with Fedora - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.0.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Remove unused scriptlets - Fix the messed scriptlets Resolves: #1929845 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Sync with rhel 8.3 + cleanup - Add new subpackages - z{14,15} - Unlike in rhel8, the base subpackage still needs to be build for z12. - Covscan related bugfixes - Spec and git cleanup (remove unused patches/sources) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop IBM z10 and z196 subpackages - s390 is now optimized for z12 Related: #1780286 - Fix compatibility with gcc 10 - Sync compiler/linker flags with RHEL - Fix parsing of multipath.conf resolves: RHEL-93649 - Rebase to Fedora Rawhide - Remove patches which are upstream - resolves: RHEL-56802 - Fix parsing of multipath.conf resolves: RHEL-93649 - Rebase to Fedora Rawhide - Remove patches which are upstream - resolves: RHEL-56802 - Support group merging in nsswitch.conf (RHEL-15779) - Fix Japanese translations (RHBZ #2153364) - Update translations (RHBZ #2189498) - Do not prompt for password twice when changing password of local user (RHBZ #2228098) - Resolves: rhbz#2121828 Fix the gating tests by using only local test Upstream testsuite will not work as this package code is very old - Resolves: rhbz#2121828 CVE-2022-32323 - heap-buffer overflow via the ReadImage() at input-bmp.c - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1961993 - Add gating tests from rhel-8 - Resolves: CVE-2019-19004 : integer overflow in input-bmp.c - Resolves: CVE-2019-19005 : fix bitmap double free in main.c - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Don't build with ImageMagick on EL - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - Fix CVE-2024-52615 (RHEL-94846) - Fix CVE-2024-52616 (RHEL-67722) - fix file attributes on /run/avahi-daemon (RHEL-5633) - avahi-client: fix resource leak (RHEL-27722) - fix resource leak in avahi_time_event_queue_new (RHEL-27717) - fix bacula compatibility with Image Mode (RHEL-6862) - fix bacula compatibility with Image Mode (RHEL-6862) - fix bacula compatibility with Image Mode (RHEL-6862) - Fix a performance regression while using large number of environment variables Resolves: RHEL-20020 - Fix an issue with adding newline in bracketed paste mode Resolves: #2168963 - Restore audit logs in bash-4.3 or newer versions Resolves: RHEL-22619 - Add a null check in parameter_brace_transform() function Resolves: CVE-2022-3715 - Fix an off by one error while calling mbrtowc() Resolves: #2115206 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Fix arbitrary bytecode produced via out-of-bounds writing - Resolves: CVE-2022-42920 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to latest upstream version Resolves: #1911871 - Update to latest upstream version Resolves: #1902975 - Update to latest upstream version Resolves: #1893002 - Update to latest upstream version Resolves: #1881276 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to latest upstream version Resolves: #1856118 - Update to latest upstream version Resolves: #1817552 - support for fmf_id nick attribute - improved performance and memory consumption of the fingerprint feature - rlImport: upwards traversal start in the current directory - rlImport: support '.' to import lib.sh from the current directory - rlImport: can handle libraries required by the fmf_id in different forms than (url, name) also name-only. Also the path attribute is considered - fingerprint: an asserts fingerprint and phases fingerprint is computed it is printed as a message and it is also available in the TestResults file - fixed a check for os-release file existence - fixed LOG_LEVEL usage - removed dependency on selinuxenabled - fixed a few typos, thanks to jwakely@fedoraproject.org - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - cleanup rlRun_LOG files at rlJournalEnd - close journal in rlDie - generate journal.xml at that moment - implemented functions rlIsOS, rlIsOSLike, rlIsOSVersion, and rlIsRHELLike - rlAssertRequired can now handle versioned dependencies - new functions rlCheckRerquired, rlCheckRecommended, and rlCheckDependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - rlCheckRequirements is now able to check also versions requirements - fixed rlServiceDisable if called without rlServiceEnable beforehand - few internal fixes - rebased yash to version 1.2, fixes the backtick iterpretation - docs fixes, by Štěpán Němec <snemec@redhat.com> - rlImport --all imports only required libraries, not recommend - implemented chkconfig fallback to systemctl - fixed `make test` test suite execution - support for fmf_id nick attribute - improved performance and memory consumption of the fingerprint feature - rlImport: upwards traversal start in the current directory - rlImport: support '.' to import lib.sh from the current directory - rlImport: can handle libraries required by the fmf_id in different forms than (url, name) also name-only. Also the path attribute is considered - fingerprint: an asserts fingerprint and phases fingerprint is computed it is printed as a message and it is also available in the TestResults file - fixed a check for os-release file existence - fixed LOG_LEVEL usage - removed dependency on selinuxenabled - fixed a few typos, thanks to jwakely@fedoraproject.org - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - cleanup rlRun_LOG files at rlJournalEnd - close journal in rlDie - generate journal.xml at that moment - implemented functions rlIsOS, rlIsOSLike, rlIsOSVersion, and rlIsRHELLike - rlAssertRequired can now handle versioned dependencies - new functions rlCheckRerquired, rlCheckRecommended, and rlCheckDependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - rlCheckRequirements is now able to check also versions requirements - fixed rlServiceDisable if called without rlServiceEnable beforehand - few internal fixes - rebased yash to version 1.2, fixes the backtick iterpretation - docs fixes, by Štěpán Němec <snemec@redhat.com> - rlImport --all imports only required libraries, not recommend - implemented chkconfig fallback to systemctl - fixed `make test` test suite execution - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix license directory permissions - Resolves: rhbz#2144648 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - skipped tests as they require user input with jdk11, changed way of javadoc generation - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to version 1.78. - Remove unnecessary parent from POM file. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix license directory permissions - Resolves: rhbz#2144648 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933563 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Use BDF fonts for OpenType conversion - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Use bitmapfonts2otb.py to combine bitmap fonts - Add bitmap-*-opentype-fonts sub packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Add explicit requires to the devel subpackages - Note: the the cblas64 seems to be linked against the libblas (not the 64 version) - this is not a regression, however in the Fedora it uses libblas64 instead. - Resolves: RHEL-5768 - Spec file cleanup - Remove unused patches Related: RHEL-5770 - Fix soname of the 64-bit version libraries Resolves: RHEL-24851 - Add explicit requires to the devel subpackages Related: rhbz#2229142 - Rename manpages: some names conflict with the man-pages package Resolves: rhbz#2222868 - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 0.9.0 - Drop patch - Turn off LTO and keeping frame pointers - Don't BR /usr/bin/python (#2237696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX licence tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Bump release to rebuild for RHEL-9.5 - Update to 5.72 - Update to 5.87 post-release snapshot Resolves: RHEL-193095 - Update to 5.87 pre-release snapshot Resolves: RHEL-169988 - Fix startup warning Resolves: RHEL-161518 - Update to 5.86 - Re-add btmgmt as it does not require bluetoothd to be running, unlike bluetoothctl mgmt - Fix audio output not working in some circumstances Resolves: RHEL-147734 - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Bump release to rebuild for RHEL-9.5 - Update to 5.72 - Update to 5.87 post-release snapshot Resolves: RHEL-193095 - Update to 5.87 pre-release snapshot Resolves: RHEL-169988 - Fix startup warning Resolves: RHEL-161518 - Update to 5.86 - Re-add btmgmt as it does not require bluetoothd to be running, unlike bluetoothctl mgmt - Fix audio output not working in some circumstances Resolves: RHEL-147734 - Update to 5.85 Resolves: RHEL-142552 - Fix problem with menu handling Resolves: RHEL-103966 - Update to 5.83 Resolves: RHEL-94819 Resolves: RHEL-56073 Resolves: RHEL-1924 - Fix plugin_init() startup warnings Related: RHEL-68934 - Fix ConfigurationDirectory startup warning Related: RHEL-71798 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: #1950909 (Change what files are installed) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Updated to 1.2.5 - No longer necessary to re-package sources: All problematic files have been re-licensed - All 19 patches are part of the 1.2.5 release and have been removed - Rebuilt for GSL 2.6. - Update to the upstream version 0.9.10 - Update to 0.9.10 - Fix bolt exits when opening an empty version file - Fix a NULL syspath variable causes SIGSEGV - Update to upstream release 0.9.7 - Support 'nopcie' security level - Add Boost.JSON patch for detecting endianness (RHEL-120655) - Fix the CMake config file for openmpi and mpich (RHEL-97588) - Add patch for cross-device filesystem::copy_file (RHEL-89888) - Re-add the CMake config files provided by Boost - Apply upstream Boost.Asio patch to resolve RHEL-67973 - Fix %patch directive compatibility with RPM 4.20 - Add Boost.JSON patch for detecting endianness (RHEL-120655) - Fix the CMake config file for openmpi and mpich (RHEL-97588) - Add patch for cross-device filesystem::copy_file (RHEL-89888) - Re-add the CMake config files provided by Boost - Apply upstream Boost.Asio patch to resolve RHEL-67973 - Fix %patch directive compatibility with RPM 4.20 - Improve default checksum hash algorithm (#1935460) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop dependencies on cdrdao, cdrkit, and dvd+rw-tools for el9+ (#1973071) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Switch to Tracker 3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Relax Requires: icedax to Recommends - Use pkgconfig for BuildRequires - Depend on tracker only on Fedora - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Improve default checksum hash algorithm (#1935460) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop dependencies on cdrdao, cdrkit, and dvd+rw-tools for el9+ (#1973071) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Switch to Tracker 3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Relax Requires: icedax to Recommends - Use pkgconfig for BuildRequires - Depend on tracker only on Fedora - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fixed brlapi multilib Resolves: rhbz#1915335 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New version Resolves: rhbz#1910328 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fixed brlapi.key to pass the RPM verification - OCaml 4.11.1 rebuild - OCaml 4.11.0 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Dropped explicit brlapi dependency (brltty) and relaxed brltty dependency (brlapi) Related: rhbz#1765611 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Related: CVE-2026-14164 - Resolves: CVE-2026-14164 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Resolves: CVE-2026-4424 - Resolves: CVE-2026-5121 - Release bump - Resolves: CVE-2026-4111 - Resolves: CVE-2025-5914 - Resolves: CVE-2025-25724 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 3.6.0 - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.5.0 - Update to upstream version 3.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rename package from maven-plugin-build-helper - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 3.6.0 - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.5.0 - Update to upstream version 3.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rename package from maven-plugin-build-helper - new version - new version - new version - new version - new version - new version - new version - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make_build RPM macro to comply with packaging guidelines - Respect system-wide linker flags during build - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.10 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 1.10.20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstram version 1.10.16 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.10 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 1.10.20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstram version 1.10.16 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.14.2 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.10 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 1.10.20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstram version 1.10.16 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.14.2 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.10 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 1.10.20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstram version 1.10.16 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.14.2 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.10 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 1.10.20 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstram version 1.10.16 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to latest upstream 4.0.16 release for JDK 17 support. - Drop not-needed jboss-modules BR. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Upgrated to latest upstream version 4.0.11 - Added a patch to fix rpm build issue caused due to misconfiguration in upstream - Added required additional plugins required for build - Drop not needed BR jarjar. Fixes FTBFS. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to latest upstream 4.0.16 release for JDK 17 support. - Drop not-needed jboss-modules BR. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Upgrated to latest upstream version 4.0.11 - Added a patch to fix rpm build issue caused due to misconfiguration in upstream - Added required additional plugins required for build - Drop not needed BR jarjar. Fixes FTBFS. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Add the explicit Rquires to the base package Resolves: RHEL-138675 - Revert the previous commit (introduced a regression) Resolves: CVE-2019-12900 - Fix out of bounds access in BZ2_decompress Resolves: RHEL-65198 - Add git as BR (#1911486) - Fix CVE-2020-35492 (#1911486) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Backport an upstream patch to fix generating PDF font names (#1939399) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.17.4 - Tighten soname globs - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Allow empty array of operands for certain operators in CFF fonts - Resolves: #1817958 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add tests - Fix compilation error due to dynamic stack sizes Resolves: rhbz#1980993 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Sync with Fedora - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Sync with Fedora - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Set maven-javadoc-plugin source to 1.8 for Java 11 build. - Ignore 5 test failures from upstream when run on Java 9 or above. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Initial package version - Fix the pkgconfig file for lib64 (#2016941) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Don't build with subinit support in RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Version 0.15.2 - Drop upstreamed -fail-macros patch - Add -fail-macros patch - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Version 0.15.1 - Drop upstreamed -format-spec patch - Drop -attribute-format patch, causes other issues (bz 1850198) - Fix the pkgconfig file for lib64 (#2016941) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Don't build with subinit support in RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Version 0.15.2 - Drop upstreamed -fail-macros patch - Add -fail-macros patch - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Version 0.15.1 - Drop upstreamed -format-spec patch - Drop -attribute-format patch, causes other issues (bz 1850198) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add isa to gstreamer plugin Requires (#1988932) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + cheese-3.38.0-2 - Fix infinite loop on exit - Update to 3.38.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for libgnome-desktop soname bump - Update to 3.34.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add isa to gstreamer plugin Requires (#1988932) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + cheese-3.38.0-2 - Fix infinite loop on exit - Update to 3.38.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for libgnome-desktop soname bump - Update to 3.34.0 - resolves: RHEL-146305 - Enable debug logs in cifs.upcall - resolves: RHEL-131406 - fix regression with cifscreds(1) - resolves: RHEL-82680 - Update to version 7.2 - Fix damaged test filename - resolves: RHEL-61732 - Update to version 7.1 - Implement CLDAP Ping to find the closest site - Resolves: RHELPLAN-17597 - mount.cifs.rst: add missing reference for sssd - mount.cifs.rst: update section about xattr/acl support - Resolves: RHEL-22495 - pam_cifscreds: fix NULL arg warning passed to pam_syslog() - Resolves: RHEL-28050 - cifs.upcall: fix UAF in get_cachename_from_process_env() - Resolves: RHEL-28047 - resolves: RHEL-192982 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185761 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-127499 - Enable debug logs in cifs.upcall - resolves: RHEL-110765 - fix regression with cifscreds(1) - resolves: RHEL-82680 - Update to version 7.2 - Fix damaged test filename - resolves: RHEL-61732 - Update to version 7.1 - resolves: RHEL-247580 - fix krb5 regression with --trust-dns - resolves: RHEL-192982 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185761 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-127499 - Enable debug logs in cifs.upcall - resolves: RHEL-110765 - fix regression with cifscreds(1) - resolves: RHEL-82680 - Update to version 7.2 - Fix damaged test filename - resolves: RHEL-61732 - Update to version 7.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove compat libs for LLVM 20 - Update LLVM Toolset to 21.1.8 [rhel-9] - Update to 21.1.7 - Backport fix for pgo optimized rust toolchain on ppc64le (rhbz#2382683) - Backport fix for crbit spill miscompile on ppc64le power9 and power10 (rhbz#2383037) - Backport fix for build of highway package on ppc64le (rhbz#2383182) - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Update to LLVM 20.1.8 - Add riscv64 enablement bits; thanks: Songsong Zhang (U2FsdGVkX1@gmail.com) and David Abdurachmanov (davidlt@rivosinc.com) - Update to LLVM 20.1.7 - Fix llvm-config alternatives handling (rhbz#2361779) - Use libdir suffix in versioned prefix - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - fixed javadoc build problem - removed javadoc, as it is broken as tooling is not ready for jdk11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - fixed javadoc build problem - removed javadoc, as it is broken as tooling is not ready for jdk11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Bump to release-39. Related: rhbz#1963078 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Bump to release-39-beta - Bump to release-39-alpha4 - Bump to release-39-alpha1 - Bump release-39-alpha0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Bump to release-38-1 - Bump release-38 - Rebase to 0.33 Resolves: bz#2133248 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Enable LTO Resolves: rhbz#1986479 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Enable LTO Resolves: rhbz#1986479 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Enable LTO Resolves: rhbz#1986492 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Disable LTO - Enable LTO Resolves: rhbz#1986479 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - resolves: rhbz#1915369 - Split out a cmocka-doc package - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Correctly build with new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable LTO - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - CVE-2026-92768 (RHEL-263127) - CVE-2026-92747 (RHEL-263114) - CVE-2026-92745 (RHEL-263111) - Convert license headers to SPDX format - Bug fixes and translation updates - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Performance improvements - Translation updates - New virtual machines don't get SPICE graphics anymore - Support for network port forwarding - Bug fixes and translation updates - Port forwarding for user session VMs - "Shutdown and restart" action - Faster startup - Memory usage now shows numbers reported by the guest (RHEL-116731) - Bug fixes and translation updates - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.22.8 - Update to 1.22.6 - Fix building against libglvnd-provided EGL headers - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.22.8 - Update to 1.22.6 - Fix building against libglvnd-provided EGL headers - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.22.8 - Update to 1.22.6 - Fix building against libglvnd-provided EGL headers - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bump release to match upstream - Provide a sysusers.d file - Bump release to match upstream - Provide a sysusers.d file - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Rebuild to fix synchronization with RHEL related: #1990361 - Initial package for RHEL 9 - Fix typo in package Summary - Resolves: RHEL-124398 - rebuild with updated dependencies: [python-]podman 4.8.0, buildah 1.33.2, skopeo 1.14.0, aardvark-dns and netavark 1.9.0 - Related: Jira:RHEL-2112 - Resolves: RHEL-123650 - Resolves: RHEL-67471 - New upstream release (RHEL-123650) - Support for running corosync-qnetd-tool and corosync-qdevice-tool as a non-root user (RHEL-67471) - Resolves: RHEL-7637 - Add support for sysusers.d functionality (RHEL-7637) - Resolves: rhbz#2040997 skip cppunit-devel - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Create directory structure under /var using tmpfiles.d Resolves: RHEL-129881 - Remove sscg option --package from cyrus-imapd-init.service Resolves: RHEL-132242 - tls: enable automatic DH parameter selection Resolves: RHEL-70762 - Update to 3.4.8, fixing CVE-2024-34055 - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly for shared mailboxes - cyrus-imapd.spec: rename patches to correspond with others - Create directory structure under /var using tmpfiles.d Resolves: RHEL-129881 - Remove sscg option --package from cyrus-imapd-init.service Resolves: RHEL-132242 - tls: enable automatic DH parameter selection Resolves: RHEL-70762 - Update to 3.4.8, fixing CVE-2024-34055 - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly for shared mailboxes - cyrus-imapd.spec: rename patches to correspond with others - Create directory structure under /var using tmpfiles.d Resolves: RHEL-129881 - Remove sscg option --package from cyrus-imapd-init.service Resolves: RHEL-132242 - tls: enable automatic DH parameter selection Resolves: RHEL-70762 - Update to 3.4.8, fixing CVE-2024-34055 - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly for shared mailboxes - cyrus-imapd.spec: rename patches to correspond with others - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2023-34969 (#2213402) - Fix CVE-2022-42010 (#2133647) - Fix CVE-2022-42011 (#2133641) - Fix CVE-2022-42012 (#2133635) - Override upstream sysusers.d confguration (#2118226) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix CVE-2023-34969 (#2213402) - Fix CVE-2022-42010 (#2133647) - Fix CVE-2022-42011 (#2133641) - Fix CVE-2022-42012 (#2133635) - Override upstream sysusers.d confguration (#2118226) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.37-15 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.37-13 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.37-12 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.37-7 ✅ Remove F32 compatibility packages - 2.37-6 ✅ Lint, lint, lint and lint again - 2.37-5 ✅ Rebuild with fonts-rpm-macros 2.0.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.37-15 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.37-13 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.37-12 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.37-7 ✅ Remove F32 compatibility packages - 2.37-6 ✅ Lint, lint, lint and lint again - 2.37-5 ✅ Rebuild with fonts-rpm-macros 2.0.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.37-15 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.37-13 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.37-12 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.37-7 ✅ Remove F32 compatibility packages - 2.37-6 ✅ Lint, lint, lint and lint again - 2.37-5 ✅ Rebuild with fonts-rpm-macros 2.0.2 - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Create /var/lib/dhcpd through systemd-tmpfiles Resolves: RHEL-134207 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - update to 1.3-20210117 - update to 1.3-20201126 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - update to 1.3-20200327 - update to 1.3-20200228 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - update to 1.3-20191210 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Build with OpenJDK 8 - Update disruptor to 3.4.4 (#1953941) - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Remove unneeded buildrequires on jmock and hamcrest - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebase to disruptor upstream release v3.4.2 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Trigger build Related: RHEL-143037 - Rebuild for posix lock issue fix Related: RHEL-143037 - new upstream version - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - suggest lynx rather than elinks to satisfy text-www-browser - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to .NET SDK 3.1.118 and Runtime 3.1.18 - Resolves: RHBZ#1961848 - Fix building and running against OpenSSL 3.0 - Resolves: RHBZ#1991050 - Update to .NET SDK 3.1.117 and Runtime 3.1.17 - Resolves: RHBZ#1961848 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Update to .NET SDK 3.1.116 and Runtime 3.1.16 - Resolves: RHBZ#1961848 - Support building against OpenSSL 3.0 - Resolves: RHBZ#1965045 - Update to .NET SDK 3.1.115 and Runtime 3.1.15 - Resolves: RHBZ#1961848 - Fix build by adding CentOS 9 RIDs - Resolves: RHBZ#1951312 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 3.1.5 - Rebase to 2.0.8 Resolves: rhbz#2223950 - bump rpm version for rhel-exception build Resolves: rhbz#2230712 - blackbox: fix buffer overflow with long log lines Resolves: rhbz#2236171 - ipc: Retry receiving credentials if the the message is short Resolves: rhbz2149647 - Rebase to 2.0.6 Resolves: rhbz#2072903 - Fix negative errno in qb_ipcc_connect (introduced in 2.0.3-4) Resolves: rhbz#2057527 - Bump soname for async-connect API addition Resolves: rhbz#bz2031865 - Fix gating.yaml for RHEL-9 Resolves: rhbz#bz2031865 - Add gating.yaml from RHEL Resolves: rhbz#bz2031865 - Add async connect call for Pacemaker Resolves: rhbz#bz2031865 - Update to 2.4.128-1 - Added amdgpu-slice.patch and amdgpu-fallback.patch - Update to 2.4.127 amdgpu-apu.patch: Read model name from /proc/cpuinfo for APUs - Revert upstream commit ffaa3ce144be ("2.4.122, Build Intel on all arches") libpciaccess is not available in RHEL 9 aarch64, ppc64le and s390x Resolves: https://issues.redhat.com/browse/RHEL-53869 - Update to 2.4.123 Resolves: https://issues.redhat.com/browse/RHEL-53869 - Update to 2.4.121 - Update to 2.4.120 - Fix findings from static application security testing (SAST) - ext2fs: make sure we have at least EXT2_FIRST_INO + 1 inodes - Fix: e2fsprogs: online resize fails - Related: RHEL-76095 - Bump release to perform build verification for gating changes - Related: RHEL-71250 - rebuild to incorporate libss-devel package - Related: RHEL-19059 - Change the xattr entry hash to use an unsighed char by default - Related: RHEL-10467 - ext2fs: make sure we have at least EXT2_FIRST_INO + 1 inodes - Fix: e2fsprogs: online resize fails - Related: RHEL-76095 - Bump release to perform build verification for gating changes - Related: RHEL-71250 - rebuild to incorporate libss-devel package - Related: RHEL-19059 - Change the xattr entry hash to use an unsighed char by default - Related: RHEL-10467 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Workaround build issue with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 4.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 4.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Workaround build issue with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 4.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - C99 port - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt with OpenSSL 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix incorrect build. - Add system flags to CFLAGS. - Remove i686 support. - Add BSD license. - Rename LGPLv2.1 to LGPLv2. - Add reference to issue about mktemp usage. - Initial SPEC release. - Bump revision number to 7. - Pull in changes from Major Hayden: - Skip version check test Opened upstream bug: https://github.com/aws/efs-utils/issues/194 - Disable automatic version check - Bump revision number to 6. - Bump release to 5 to include selinux-policy-targeted-38.1.28-1 release. - Refactor watchdog service name - Added deprecation warning patch. - Added SELinux policies. (RHEL-14154) - Add patch for ignoring the fsap option. - Initial package for version 1.31.38 - Bump revision number to 7. - Pull in changes from Major Hayden: - Skip version check test Opened upstream bug: https://github.com/aws/efs-utils/issues/194 - Disable automatic version check - Bump revision number to 6. - Bump release to 5 to include selinux-policy-targeted-38.1.28-1 release. - Refactor watchdog service name - Added deprecation warning patch. - Added SELinux policies. (RHEL-14154) - Add patch for ignoring the fsap option. - Initial package for version 1.31.38 - Backport upstream patches Resolves: #2137486 - Update to 3.4.0 Resolves: #2032423 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove glew-devel BR Resolves: #1981397 - Added missing Minpack license Dropped unnecessary dependencies Resolves: #1967481 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - make the code build with lua-5.4.x - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix covscan report. Related: rhbz#2068287 - Rebuild to add anthy-unicode-devel to CRB. Related: rhbz#2068287 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix covscan report. Related: rhbz#1963073 - Delete unnecessary xemacs in tests/tests.yml. Related: rhbz#1956212 - Enable CI. Related: rhbz#1956212 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Bump 1.0.0.20201109 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix build failure on CentOS Stream. Related: rhbz#1951306 - Revert patch for FSF addresses (it became obsolete with 12.2) - Remove Obsoletes and Provides tetex-preview - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix nsm-should-check for "google.com" failure (RHEL-94297) - Fix package tests for tetris no longer existing as a package (RHEL-94297) - Introduce untrusted-content variable (RHEL-94297) - Pong and Tetris are excluded (RHEL-94297) - Fix flymake tests with GCC 14 (RHEL-94297) - Restore definition of variable "enable-dir-local-variables" (RHEL-92550) - Fix arbitrary code execution via Lisp macro expansion (RHEL-90181) - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) - Bump release - Eliminate use of obsolete patch syntax (RHEL-80443) - Fix man.el shell injection vulnerability (RHEL-79025) - Disable xwidgets (RHEL-14551) - org-file-contents: Consider all remote files unsafe (CVE-2024-30205) - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203) - Add protection for LaTeX preview (CVE-2024-30204) - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331) - Fix integer overflow in pbm_load image validation (RHEL-248067) - Restrict Tramp user name to fix CVE-2026-79992 (RHEL-248552) - Fix nsm-should-check for "google.com" failure (RHEL-94297) - Fix package tests for tetris no longer existing as a package (RHEL-94297) - Introduce untrusted-content variable (RHEL-94297) - Pong and Tetris are excluded (RHEL-94297) - Fix flymake tests with GCC 14 (RHEL-94297) - Restore definition of variable "enable-dir-local-variables" (RHEL-92550) - Fix arbitrary code execution via Lisp macro expansion (RHEL-90181) - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) - Bump release - Eliminate use of obsolete patch syntax (RHEL-80443) - Fix man.el shell injection vulnerability (RHEL-79025) - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - Resolves: RHEL-265110 - Fix integer overflow in pbm_load image validation (RHEL-248067) - Restrict Tramp user name to fix CVE-2026-79992 (RHEL-248552) - Fix nsm-should-check for "google.com" failure (RHEL-94297) - Fix package tests for tetris no longer existing as a package (RHEL-94297) - Introduce untrusted-content variable (RHEL-94297) - Pong and Tetris are excluded (RHEL-94297) - Fix flymake tests with GCC 14 (RHEL-94297) - Restore definition of variable "enable-dir-local-variables" (RHEL-92550) - Fix arbitrary code execution via Lisp macro expansion (RHEL-90181) - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) - Bump release - Eliminate use of obsolete patch syntax (RHEL-80443) - add Java 17 support patch from Mamoru Tasaka (rhbz#2182696) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers Add gettext-0.21-disable-libtextstyle.patch Do not build libtextstyle, as it depends on libcroco which is now unmaintained and has known security bugs. Obsolete libtextstyle and libtextstyle-devel packages. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix nsm-should-check for "google.com" failure (RHEL-94297) - Fix package tests for tetris no longer existing as a package (RHEL-94297) - Introduce untrusted-content variable (RHEL-94297) - Pong and Tetris are excluded (RHEL-94297) - Fix flymake tests with GCC 14 (RHEL-94297) - Restore definition of variable "enable-dir-local-variables" (RHEL-92550) - Fix arbitrary code execution via Lisp macro expansion (RHEL-90181) - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) - Bump release - Eliminate use of obsolete patch syntax (RHEL-80443) - Fix man.el shell injection vulnerability (RHEL-79025) - Disable xwidgets (RHEL-14551) - org-file-contents: Consider all remote files unsafe (CVE-2024-30205) - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203) - Add protection for LaTeX preview (CVE-2024-30204) - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331) - Fix integer overflow in pbm_load image validation (RHEL-248067) - Restrict Tramp user name to fix CVE-2026-79992 (RHEL-248552) - Fix nsm-should-check for "google.com" failure (RHEL-94297) - Fix package tests for tetris no longer existing as a package (RHEL-94297) - Introduce untrusted-content variable (RHEL-94297) - Pong and Tetris are excluded (RHEL-94297) - Fix flymake tests with GCC 14 (RHEL-94297) - Restore definition of variable "enable-dir-local-variables" (RHEL-92550) - Fix arbitrary code execution via Lisp macro expansion (RHEL-90181) - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) - Bump release - Eliminate use of obsolete patch syntax (RHEL-80443) - Fix man.el shell injection vulnerability (RHEL-79025) - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - Resolves: RHEL-265110 - Fix integer overflow in pbm_load image validation (RHEL-248067) - Restrict Tramp user name to fix CVE-2026-79992 (RHEL-248552) - Fix nsm-should-check for "google.com" failure (RHEL-94297) - Fix package tests for tetris no longer existing as a package (RHEL-94297) - Introduce untrusted-content variable (RHEL-94297) - Pong and Tetris are excluded (RHEL-94297) - Fix flymake tests with GCC 14 (RHEL-94297) - Restore definition of variable "enable-dir-local-variables" (RHEL-92550) - Fix arbitrary code execution via Lisp macro expansion (RHEL-90181) - Fix arbitrary code execution via Lisp macro expansion (RHEL-69399) - Bump release - Eliminate use of obsolete patch syntax (RHEL-80443) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: rhbz#1974636 Fix license tag - Resolves: rhbz#1974636 Delete ibus write-cache in scriptlet - Improve CI tests and add gating.yaml - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 2.11.0 - Use sensitivity feature of buttons in the setup tool tab where shortcuts are defined - Don’t let dialog action area of setup tool expand. - Improve the setup tool to make it possible to enter multi-line expansions of shortcuts - Resolves https://github.com/mike-fabian/ibus-typing-booster/issues/158 - Elide extremely long candidates in the lookup table in the middle. - If a candidate contains newlines, replace the newlines with arrows in the lookup table. - If a commit string contains new-lines, commit it in several chunks and forward Return between the chunks. - Update emoji annotations from CLDR - Put the remote icon back in emoji-picker.appdata.xml, it was a false positive by appstreamcli - Translation update from Weblate (pt_PT updated, 100% complete now) - Skip the inscript2 test cases if these transliterations are not available. - Remove gnome-desktop-testing and ibus-desktop-testing from the requires of the ibus-typing-booster-tests subpackage - Use the voikko build requires only for Fedora. They are only needed to run the voikko test cases during build. - Update to 2.10.5 - Run the voikko tests only for libvoikko version >= 4.3 - Adapt voikko test cases to the newest voikko version libvoikko-4.3-3, python3-libvoikko-4.3-3, voikko-fi-2.4-3 - Log a warning when language is “fi” and “import libvoikko” failed - Return an empty list [] in spellcheck_suggest_voikko() when libvoikko was not imported - Update emoji annotations from CLDR, switching “no” and “nb” See: https://unicode-org.atlassian.net/browse/CLDR-2698 - Remove icon in emoji-picker.appdata.xml (to avoid warnings from appstream-util and appstreamcli). - Use “BuildRequires: appstream” only on Fedora - Update to 2.10.4 - Use “from unittest import mock” instead of just “import mock”. - Update emoji annotations from CLDR - Translation update from Weblate for zh_CN (still 100% complete) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: #1961175 (Missing man page for enchant-lsmod) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: #1961175 (Missing man page for enchant-lsmod) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Disable nuspell support for RHEL (#1925839) - Include support for Nuspell. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.2.15 - Update to 2.2.14 - Update to 2.2.13 - Update to 2.2.12 - Update to 2.2.11 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Disable nuspell support for RHEL (#1925839) - Include support for Nuspell. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.2.15 - Update to 2.2.14 - Update to 2.2.13 - Update to 2.2.12 - Update to 2.2.11 - Add 'Provides: bundled(libjpeg)' Resolves: #1998486 - Update to 40.3 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 40.1 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 40.0 - Update to 40.rc - Disable installed tests on RHEL - Update to 40.beta - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove the use of $releasever rhbz#2219796 - Tweak crb script. Fix for RHEL rhui repos (#2308671) - Fix typo to actually enable EPEL OpenH264 repo - Add EPEL OpenH264 repository (#2053295) - Tweak crb script, check os-release for RHEL (#2186721) - Fix gating.yaml - Related: rhbz#2190221 - Rebuild for rhbz#2190221 - Resolves: rhbz#2190221 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix gating.yaml - Related: rhbz#2190221 - Rebuild for rhbz#2190221 - Resolves: rhbz#2190221 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix a leak - Resolves: RHEL-84038 - Allow launch action to open PDFs - Resolves: RHEL-84038 - Sanitize arguments (CVE-2026-46529) - Resolves: RHEL-184047 - Fix a leak - Resolves: RHEL-84038 - Allow launch action to open PDFs - Resolves: RHEL-84038 - Fix a leak - Resolves: RHEL-84038 - Allow launch action to open PDFs - Resolves: RHEL-84038 - Sanitize arguments (CVE-2026-46529) - Resolves: RHEL-184047 - Fix a leak - Resolves: RHEL-84038 - Allow launch action to open PDFs - Resolves: RHEL-84038 - Resolves: RHEL-111953 (WebKitGTK 2.49.4: JavaScript evaluation result serialization changes) - Resolves: RHEL-62668 (WebKitGTK 2.46.1: Middle mouse button inserts primary clipboard twice) - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - Fix parsing of large tokens - Reject direct parameter entity recursion - Resolves: RHEL-29699 - Resolves: RHEL-29696 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221014 - Fix CVE-2026-50219 - Resolves: RHEL-220981 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221014 - Fix CVE-2026-50219 - Resolves: RHEL-220981 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Fix CVE-2024-45490, CVE-2024-45491, CVE-2024-45492 - Resolves: RHEL-56761 - Resolves: RHEL-57520 - Resolves: RHEL-57511 - CVE-2026-102633 expat: expat: Denial of Service via integer overflow in expat_realloc - Resolves: RHEL-272833 - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer over-read in XML_ParseBuffer - Resolves: RHEL-277510 - Fix CVE-2026-66046: dtdCopy out-of-bounds access via isCdata hash lookup - Resolves: RHEL-260179 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input - Resolves: RHEL-269002 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221014 - Fix CVE-2026-50219 - Resolves: RHEL-220981 - Fix CVE-2026-45186 - Resolves: RHEL-177988 - Fix CVE-2025-59375 - Resolves: RHEL-114643 - Fix CVE-2024-8176 - Resolves: RHEL-57489 - Fix CVE-2024-50602 - Resolves: RHEL-65066 - Rebuilt for -devel add to CRB Resolves: RHEL-18979 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Implement bootstrap mode - Initial release - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.8.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Implement bootstrap mode - Initial release - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.8.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to version 69 - Resolves: RHEL-100266 - Rebase to version 56 - Rebase to version 75 - Resolves: RHEL-188300 - Rebase to version 69 - Resolves: RHEL-100266 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 9 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 8 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.11.8 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 1.11.6. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to version 1.11.6. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 1.11.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.11.8 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 1.11.6. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Use systemd sysusers config to create user and group Resolves: RHEL-78736 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix TypeError: 'NoneType' object is not callable in magic.close() Resolves: RHEL-136523 - Fixing gating.yaml - Update fmf plans and gating - Add ownership of /etc/default, /usr/share/X11/fonts, /usr/share/fish, /usr/share/zsh - Improve directory creation to avoid 'Argument list too long' error Resolves: RHEL-35327 Resolves: RHEL-1337 Resolves: RHEL-1338 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Disable FTDI support to remove one extra dep we are not going to support - Resolves: rhbz#1961170 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Disable JLink support to remove one extra dep we are not going to support - Resolves: rhbz#1948597 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Added jlink support - Perform source file verification during %prep - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Build the package using meson to get the libflashrom shared library support required by fwupd. - Update to flashrom 1.2 (Release was intended to fix #1799344) - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165643 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170171 - Use sysusers_create_compat macro to create user & group Resolves: RHEL-82605 - Fix previous changelog entry - Backport upstream patches for CVE-2024-42472 - Require bubblewrap version that has new --bind-fd option backported for addressing CVE-2024-42472 - Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280) Resolves: RHEL-271518 - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267902 - Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275) Resolves: RHEL-267434 - Harden data dir and var setup against symlink attacks Resolves: RHEL-258975 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165643 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170171 - Use sysusers_create_compat macro to create user & group Resolves: RHEL-82605 - Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024) Resolves: RHEL-272190 - Avoid path traversal deletion via deploy export/bin (CVE-2026-97023) Resolves: RHEL-272030 - Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280) Resolves: RHEL-271518 - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267902 - Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275) Resolves: RHEL-267434 - Harden data dir and var setup against symlink attacks Resolves: RHEL-258975 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165643 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170171 - Use sysusers_create_compat macro to create user & group Resolves: RHEL-82605 - Update to 1.0.5 - Enable installed tests Resolves: #2062206 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add flatpak- prefix to executables to avoid conflicting with xdg-utils - Add explicit conflicts with xdg-utils - Update to 1.0.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - backport the following fixes from Fedora: - fix header conflicts in multilib installs (RHEL-134741) - fix rpmlint warnings - 1.3.8 Resolves: bz#2025415 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - 1.3.6 Resolves: bz#1976712 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove BuildRequires xprop entirely. If present, the configure script will call it looking for a property on the root window that Fedora's X server does not set, and which would not work anyway since there is no X server running in the buildroot, so we can just remove the dependency. - 1.3.8 Resolves: bz#2025415 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - 1.3.6 Resolves: bz#1976712 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove BuildRequires xprop entirely. If present, the configure script will call it looking for a property on the root window that Fedora's X server does not set, and which would not work anyway since there is no X server running in the buildroot, so we can just remove the dependency. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Resolves: RHEL-138222 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138206 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138228 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138158 CVE-2025-15269 SFD File Parsing Use-After-Free - Resolves: RHEL-26716 - CVE-2024-25081 and CVE-2024-25082 fontforge: various flaws - Resolves: RHEL-138222 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138206 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138228 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138158 CVE-2025-15269 SFD File Parsing Use-After-Free - Resolves: RHEL-26716 - CVE-2024-25081 and CVE-2024-25082 fontforge: various flaws - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 4.19.1 version (#1921968) - Update to 4.19.0 version (#1920265) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 4.18.2 version (#1908485) - Update to 4.18.1 version (#1906095) - Update to 4.18.0 version (#1904631) - Update to 4.17.1 version (#1898343) - Update to 4.17.0 version (#1897467) - Use GFDL abbreviation as GFDLv1.1+ is not listed - Install PAM module into /usr - Pull in further test fixes - Pull in build/test fixes from upstream Related: #1996636 - Update to 1.94.0 Resolves: #1996636 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.90.9 (#1915788) Resolves: #1909669 Resolves: #1909559 - Rebuild for libnss dependency issue - Update to 1.90.8 (#1902255) This fixes PAM not working when fprintd was just started - Update to 1.90.7 (#1902255) Resolves: #1905667 Resolves: #1905964 - Fix for CVE-2025-27363 out-of-bound write vulnerability - Patch initially by Marc Deslauriers of Canonical - https://www.openwall.com/lists/oss-security/2025/03/14/3 - Adjusted for EL9 by Jonathan Wright of AlmaLinux - and a member of the Meta security team - Resolves: RHEL-83105 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Apply coverity fixes also to bundled libmy - Update to 0.6.1 (#1946415) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Allow dependent packages to build on Java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use source tarball from GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use AlmaLinux cert - Rebase to get new hardware support - Resolves: #RHEL-125778 - Rebase to get new hardware support - Resolves: #RHEL-82423 - Rebase to get new hardware support - Resolves: #RHEL-82423 - Rebase to get hardware support for CERTPX-13842 - Resolves: #RHEL-16637 - Resolves: #RHEL-35373 - Resolves: #RHEL-61930 - Use AlmaLinux cert - Rebase to get new hardware support - Resolves: #RHEL-125778 - Rebase to get new hardware support - Resolves: #RHEL-82423 - Rebase to get new hardware support - Resolves: #RHEL-82423 - Rebase to get hardware support for CERTPX-13842 - Resolves: #RHEL-16637 - Resolves: #RHEL-35373 - Resolves: #RHEL-61930 Fix the issue with incorect handling of return values of some processes Resolves: rhbz#2055107 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - Split the package into the main package and locales subpackage - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553 Fix the issue with incorect handling of return values of some processes Resolves: rhbz#2055107 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - Split the package into the main package and locales subpackage - Fix use after free in io.c - Fix buffer overflow in extensions/readdir.c - Fix integer overflow in buildin.c Resolves: CVE-2026-40467 Resolves: CVE-2026-40468 Resolves: CVE-2026-40553 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - New upstream release - New upstream release - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Re-enable building with LTO. (#2166579) - Annocheck: Fix atexit test. Fix recording of version numbers. (#2165528) - Annocheck: Fix handling of file built by multiple versions of gcc. (#2160700) - Spec file: Enable annotated building. - Annocheck: Fix handling of empty files. (#2159292) - Annocheck: Add crti.o and crtn.o to the list of known glibc special files. (#2158740) - Annocheck: Fix memory leaks. - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment. (#2158386) - Annocheck: Add more special glibc filenames. (#2158100) - Annocheck: Improve handling of tool versions. - GCC Plugin: Fix building with gcc-13. - Annocheck: Add test for binaries built by cross compilers. - Annocheck: Improve heuristic used to detect binaries without code. (#2144533) - Annocheck: Use real filename rather than debuginfo filename. (#2152280) - Rename gcc plugin to gts-annobin. (#2111977) - Re-enable building with LTO. (#2166579) - Annocheck: Fix atexit test. Fix recording of version numbers. (#2165528) - Annocheck: Fix handling of file built by multiple versions of gcc. (#2160700) - Spec file: Enable annotated building. - Annocheck: Fix handling of empty files. (#2159292) - Annocheck: Add crti.o and crtn.o to the list of known glibc special files. (#2158740) - Annocheck: Fix memory leaks. - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment. (#2158386) - Annocheck: Add more special glibc filenames. (#2158100) - Annocheck: Improve handling of tool versions. - GCC Plugin: Fix building with gcc-13. - Annocheck: Add test for binaries built by cross compilers. - Annocheck: Improve heuristic used to detect binaries without code. (#2144533) - Annocheck: Use real filename rather than debuginfo filename. (#2152280) - Rename gcc plugin to gts-annobin. (#2111977) - Do not build -minimal package for GTS. - NVR bump to include {gating,rpminspect}.yaml. - Rebuild w/SCL prefix. - Rebase GTS (RH BZ 2077494). - Backport upstream patch which removes sizes from debuginfod download messages when the size is not available (RHBZ 2068280, Aaron Merey). - On ix86, add -Wno-format-overflow to --enable-gdb-build-warnings. (This is a workaround for the bogus warning/error that we now see on i686 regarding a "may write a terminating nul past the end of the destination" message for the sprintf() call in global_symbol_searcher::search() in gdb/symtab.c.) - Rebase to FSF GDB 11.2. - Fix "sect_index_data not initialized" internal error. (RHBZ 2042664, Kevin Buettner). - Fix buld issues. (RHBZ 2042257, Keith Seitz, Andrew Burgess) - Update libipt to 2.0.5. - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Do not build -minimal package for GTS. - NVR bump to include {gating,rpminspect}.yaml. - Rebuild w/SCL prefix. - Rebase GTS (RH BZ 2077494). - Backport upstream patch which removes sizes from debuginfod download messages when the size is not available (RHBZ 2068280, Aaron Merey). - On ix86, add -Wno-format-overflow to --enable-gdb-build-warnings. (This is a workaround for the bogus warning/error that we now see on i686 regarding a "may write a terminating nul past the end of the destination" message for the sprintf() call in global_symbol_searcher::search() in gdb/symtab.c.) - Rebase to FSF GDB 11.2. - Fix "sect_index_data not initialized" internal error. (RHBZ 2042664, Kevin Buettner). - Fix buld issues. (RHBZ 2042257, Keith Seitz, Andrew Burgess) - Update libipt to 2.0.5. - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebase to bring in improvements for locating string notes. (RHEL-79807) - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files. (RHEL-79264) - Annocheck: Fix resource leak. (RHEL-79253) - Annocheck: Fix double free. Add special handling for COMBOOT modules. - Annocheck: Improve diagnostics when a separate debug info file cannot be found. - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77328) - Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76456) - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-760404) - Annocheck: Fix the --debug-dir option. - Annocheck: Fix corrupt warning message when unable to locate separate debug info files. - Annocheck: Remove spurious debugging messages. - Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778) - Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349) - Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296) - GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429) - Testsuite: Use configured compiler when running tests. - GCC Plugin: Fix building with gcc 15. (#32429) - Annocheck: Fix overly long debug messages. - Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail. - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries. - Annocheck: Add --enable-future to enable future fail components in normal tests. - Annocheck: Fix bug preventing the inclusion of the rpm name in reports. - Annocheck: Add more exceptions for gcc binaries. (RHEL-33365) - Annocheck: Add --skip-passes option. - Annocheck: Add exceptions for gcc binaries. (RHEL-33365) - Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797) - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411) - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS. - Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069) - BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497) - Spec File: Use correct names for the symlinks. (RHEL-53574) - Spec File: Use correct names for the symlinks. (RHEL-53574) - Rebase to 12.65. (RHEL-51018) - Annocheck: Fix recording arguments for later re-use. (RHEL-50802) - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3. - Annocheck: Add improvements to the builtby utility. - Annocheck: Add support for ADA binaries. - Annocheck: Add support for binaries built from more than two high level source languages. - Annocheck: Add support for object files containing no executable code. - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack. - Annocheck: Add support for Fortran binaries. - Annocheck: Add heuristic for detecting parts of the CGO runtime library. - Annocheck: Add improvements for handling Clang runtime binaries. - Annocheck: Add tweaks for mixed Rust/C binaries. (#2284605) - Annocheck: Add more glibc source file names. - Annocheck: Skip GAPS test for GO binaries. (RHEL-36308) - Annocheck: Remove some false positives for Rust binaries. (#2280239) - Annocheck: Defer passing the branch protection test until all notes have been checked. - GCC Plugin: Add extra code for detecting the branch protection setting. (RHEL-35958) - Rebuild with LLVM 18. (RHEL-49954) - Rebase to 12.52 in order to bring in fixes for LLVM 18. - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505) - LLVM Plugin: Fix building with LLVM version 17. (RHEL-17311) - GCC Plugin: Add support for -fhardended. - Update glibc detection heuristics for PPC64. (RHEL-16453) - Fix another atexit test failure. (#2247481) - Fix atexit test failure. - Notes: Add support for string format notes. - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays - Annobin: Add future test of these options. - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration. - Annobin: Add test for these warnings. - GCC Plugin: Enable string note format by default. - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers. - Annocheck: Add test for FIPS compliant GO binaries. - Annocheck: Fix double free. (#2226749) - Annocheck: Ignore AArch64 $x and $d symbols. (#2221192) - GCC Plugin: Suppress active checks for fortran sources. Improve scanning of COLLECT_GCC_OPTIONS. - Annocheck: Remove dependency upon libiberty. - Rebase to bring in improvements for locating string notes. (RHEL-79807) - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files. (RHEL-79264) - Annocheck: Fix resource leak. (RHEL-79253) - Annocheck: Fix double free. Add special handling for COMBOOT modules. - Annocheck: Improve diagnostics when a separate debug info file cannot be found. - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77328) - Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76456) - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-760404) - Annocheck: Fix the --debug-dir option. - Annocheck: Fix corrupt warning message when unable to locate separate debug info files. - Annocheck: Remove spurious debugging messages. - Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778) - Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349) - Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296) - GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429) - Testsuite: Use configured compiler when running tests. - GCC Plugin: Fix building with gcc 15. (#32429) - Annocheck: Fix overly long debug messages. - Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail. - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries. - Annocheck: Add --enable-future to enable future fail components in normal tests. - Annocheck: Fix bug preventing the inclusion of the rpm name in reports. - Annocheck: Add more exceptions for gcc binaries. (RHEL-33365) - Annocheck: Add --skip-passes option. - Annocheck: Add exceptions for gcc binaries. (RHEL-33365) - Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797) - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411) - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS. - Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069) - BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497) - Spec File: Use correct names for the symlinks. (RHEL-53574) - Spec File: Use correct names for the symlinks. (RHEL-53574) - Rebase to 12.65. (RHEL-51018) - Annocheck: Fix recording arguments for later re-use. (RHEL-50802) - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3. - Annocheck: Add improvements to the builtby utility. - Annocheck: Add support for ADA binaries. - Annocheck: Add support for binaries built from more than two high level source languages. - Annocheck: Add support for object files containing no executable code. - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack. - Annocheck: Add support for Fortran binaries. - Annocheck: Add heuristic for detecting parts of the CGO runtime library. - Annocheck: Add improvements for handling Clang runtime binaries. - Annocheck: Add tweaks for mixed Rust/C binaries. (#2284605) - Annocheck: Add more glibc source file names. - Annocheck: Skip GAPS test for GO binaries. (RHEL-36308) - Annocheck: Remove some false positives for Rust binaries. (#2280239) - Annocheck: Defer passing the branch protection test until all notes have been checked. - GCC Plugin: Add extra code for detecting the branch protection setting. (RHEL-35958) - Rebuild with LLVM 18. (RHEL-49954) - Rebase to 12.52 in order to bring in fixes for LLVM 18. - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505) - LLVM Plugin: Fix building with LLVM version 17. (RHEL-17311) - GCC Plugin: Add support for -fhardended. - Update glibc detection heuristics for PPC64. (RHEL-16453) - Fix another atexit test failure. (#2247481) - Fix atexit test failure. - Notes: Add support for string format notes. - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays - Annobin: Add future test of these options. - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration. - Annobin: Add test for these warnings. - GCC Plugin: Enable string note format by default. - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers. - Annocheck: Add test for FIPS compliant GO binaries. - Annocheck: Fix double free. (#2226749) - Annocheck: Ignore AArch64 $x and $d symbols. (#2221192) - GCC Plugin: Suppress active checks for fortran sources. Improve scanning of COLLECT_GCC_OPTIONS. - Annocheck: Remove dependency upon libiberty. - Rebase to bring in improvements for locating string notes. (RHEL-79807) - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files. (RHEL-79264) - Annocheck: Fix resource leak. (RHEL-79253) - Annocheck: Fix double free. Add special handling for COMBOOT modules. - Annocheck: Improve diagnostics when a separate debug info file cannot be found. - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77328) - Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76456) - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-760404) - Annocheck: Fix the --debug-dir option. - Annocheck: Fix corrupt warning message when unable to locate separate debug info files. - Annocheck: Remove spurious debugging messages. - Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778) - Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349) - Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296) - GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429) - Testsuite: Use configured compiler when running tests. - GCC Plugin: Fix building with gcc 15. (#32429) - Annocheck: Fix overly long debug messages. - Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail. - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries. - Annocheck: Add --enable-future to enable future fail components in normal tests. - Annocheck: Fix bug preventing the inclusion of the rpm name in reports. - Annocheck: Add more exceptions for gcc binaries. (RHEL-33365) - Annocheck: Add --skip-passes option. - Annocheck: Add exceptions for gcc binaries. (RHEL-33365) - Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797) - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411) - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS. - Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069) - BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497) - Spec File: Use correct names for the symlinks. (RHEL-53574) - Spec File: Use correct names for the symlinks. (RHEL-53574) - Rebase to 12.65. (RHEL-51018) - Annocheck: Fix recording arguments for later re-use. (RHEL-50802) - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3. - Annocheck: Add improvements to the builtby utility. - Annocheck: Add support for ADA binaries. - Annocheck: Add support for binaries built from more than two high level source languages. - Annocheck: Add support for object files containing no executable code. - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack. - Annocheck: Add support for Fortran binaries. - Annocheck: Add heuristic for detecting parts of the CGO runtime library. - Annocheck: Add improvements for handling Clang runtime binaries. - Annocheck: Add tweaks for mixed Rust/C binaries. (#2284605) - Annocheck: Add more glibc source file names. - Annocheck: Skip GAPS test for GO binaries. (RHEL-36308) - Annocheck: Remove some false positives for Rust binaries. (#2280239) - Annocheck: Defer passing the branch protection test until all notes have been checked. - GCC Plugin: Add extra code for detecting the branch protection setting. (RHEL-35958) - Rebuild with LLVM 18. (RHEL-49954) - Rebase to 12.52 in order to bring in fixes for LLVM 18. - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505) - LLVM Plugin: Fix building with LLVM version 17. (RHEL-17311) - GCC Plugin: Add support for -fhardended. - Update glibc detection heuristics for PPC64. (RHEL-16453) - Fix another atexit test failure. (#2247481) - Fix atexit test failure. - Notes: Add support for string format notes. - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays - Annobin: Add future test of these options. - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration. - Annobin: Add test for these warnings. - GCC Plugin: Enable string note format by default. - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers. - Annocheck: Add test for FIPS compliant GO binaries. - Annocheck: Fix double free. (#2226749) - Annocheck: Ignore AArch64 $x and $d symbols. (#2221192) - GCC Plugin: Suppress active checks for fortran sources. Improve scanning of COLLECT_GCC_OPTIONS. - Annocheck: Remove dependency upon libiberty. - Fix a potential illegal memory access when linking a corrupt input file. (RHEL-130655) - Run x86_64 assembler tests for znver5 architecture extension. (RHEL-23798) - Add support for AMD's znver5 architecture extension. (RHEL-23798) - Spec File: Restore the SElinux context to %{_libdir}. (RHEL-22818) - [2.40-18: was a failed attempt to fix RHEL-22818] - Spec File: Do not use of the system zlib by default. (RHEL-19373) - Spec File: Do not check the mtime of ld.bfd. (RHEL-21303) - Disable building static libraries with LTO. (RHEL-18800) - Fix issue introduced when backporting the recursion limit to the rust demangler. - Backport "Fix typo in recent code to add stack recursion limit to the Rust demangler." (Nick Clifton) - Backport "Add a recursion limit to the demangle_const function in the Rust demangler." (Nick Clifton, RHEL-4234) - Backport "Update gdb-add-index.sh ..." (Andrew Burgess, RHBZ 2213228) - Backport binutls/29699 "Fix an illegal memory access when parsing..." (Nick Clifton, RHBZ 2153228) - Initial import for GTS13. - Tweak gdb-6.3-rh-testversion-20041202.patch so that $_gdb_major and $_gdb_minor will be obtained correctly. - Remove gdb-rhbz1398387-tab-crash-test.patch as that test didn't work anymore. - NVR bump for failed build. - More tweaks to gdb-6.6-buildid-locate-rpm.patch, in which rpmTag is replaced with rpmDbiTagVal. From Sergey Mende: - Backport upstream patch "gdb: call check_typedef at beginning of dwarf_expr_context::fetch_result". (Simon Marchi) - Fix issue introduced when backporting the recursion limit to the rust demangler. - Backport "Fix typo in recent code to add stack recursion limit to the Rust demangler." (Nick Clifton) - Backport "Add a recursion limit to the demangle_const function in the Rust demangler." (Nick Clifton, RHEL-4234) - Backport "Update gdb-add-index.sh ..." (Andrew Burgess, RHBZ 2213228) - Backport binutls/29699 "Fix an illegal memory access when parsing..." (Nick Clifton, RHBZ 2153228) - Initial import for GTS13. - Tweak gdb-6.3-rh-testversion-20041202.patch so that $_gdb_major and $_gdb_minor will be obtained correctly. - Remove gdb-rhbz1398387-tab-crash-test.patch as that test didn't work anymore. - NVR bump for failed build. - More tweaks to gdb-6.6-buildid-locate-rpm.patch, in which rpmTag is replaced with rpmDbiTagVal. From Sergey Mende: - Backport upstream patch "gdb: call check_typedef at beginning of dwarf_expr_context::fetch_result". (Simon Marchi) - bump for another rebuild (RHEL-78382) - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78382) - fix wrong RTL patterns for vector merge high/low word on LE (RHEL-45190) - update from releases/gcc-13 branch - PRs ada/114398, ada/114708, c/114493, c++/111529, c++/113598, fortran/110415, fortran/114827, fortran/115150, libstdc++/114940, libstdc++/115269, middle-end/108789, rtl-optimization/114902, rtl-optimization/115092, target/113281, target/113719, target/115297, target/115317, target/115324, tree-optimization/115192, tree-optimization/115307, tree-optimization/115337 - fix a shell condition (RHEL-40722) - backport a fix for modes_1.f90 (RHEL-40234) - fix up pointer types to may_alias structures (PR c/114493, RHEL-40244) - update from releases/gcc-13 branch - GCC 13.3 release - PRs analyzer/104042, analyzer/108171, analyzer/109251, analyzer/109577, analyzer/110014, analyzer/110112, analyzer/110700, analyzer/110882, analyzer/111289, analyzer/112790, analyzer/112889, analyzer/112969, analyzer/113253, analyzer/113333, analyzer/114408, analyzer/114473, bootstrap/106472, bootstrap/114369, c/112571, c/114780, c++/89224, c++/97990, c++/100667, c++/103825, c++/110006, c++/111284, c++/112769, c++/113141, c++/113966, c++/114303, c++/114377, c++/114537, c++/114561, c++/114562, c++/114572, c++/114580, c++/114634, c++/114691, c++/114709, debug/112718, driver/111700, fortran/36337, fortran/50410, fortran/55978, fortran/89462, fortran/93678, fortran/95374, fortran/101135, fortran/102003, fortran/103707, fortran/103715, fortran/103716, fortran/104352, fortran/106987, fortran/106999, fortran/107426, fortran/110987, fortran/112407, fortran/113799, fortran/113866, fortran/113885, fortran/113956, fortran/114001, fortran/114474, fortran/114535, fortran/114739, fortran/114825, fortran/115039, gcov-profile/114115, gcov-profile/114715, ipa/92606, ipa/108007, ipa/111571, ipa/112616, ipa/113359, ipa/113907, ipa/113964, jit/110466, libgcc/111731, libquadmath/114533, libstdc++/66146, libstdc++/93672, libstdc++/104606, libstdc++/107800, libstdc++/108976, libstdc++/110050, libstdc++/110054, libstdc++/113841, libstdc++/114147, libstdc++/114316, libstdc++/114359, libstdc++/114367, libstdc++/114401, libstdc++/114750, libstdc++/114803, libstdc++/114863, libstdc++/115063, lto/114655, middle-end/110027, middle-end/111151, middle-end/111632, middle-end/111683, middle-end/112684, middle-end/112732, middle-end/113396, middle-end/113622, middle-end/114070, middle-end/114348, middle-end/114552, middle-end/114599, middle-end/114734, middle-end/114753, middle-end/114907, rtl-optimization/54052, rtl-optimization/114415, rtl-optimization/114768, rtl-optimization/114924, sanitizer/97696, sanitizer/114687, sanitizer/114743, sanitizer/114956, sanitizer/115172, target/88309, target/101865, target/105522, target/110621, target/111234, target/111600, target/111610, target/111822, target/112397, target/113095, target/113233, target/113950, target/114049, target/114130, target/114160, target/114172, target/114175, target/114272, target/114747, target/114752, target/114794, target/114837, target/114848, target/114981, testsuite/111066, testsuite/112297, testsuite/114034, testsuite/114036, testsuite/114662, tree-optimization/91838, tree-optimization/109925, tree-optimization/110838, tree-optimization/111009, tree-optimization/111268, tree-optimization/111407, tree-optimization/111736, tree-optimization/111882, tree-optimization/112281, tree-optimization/112303, tree-optimization/112793, tree-optimization/112961, tree-optimization/112991, tree-optimization/113552, tree-optimization/113630, tree-optimization/113670, tree-optimization/113831, tree-optimization/113910, tree-optimization/114027, tree-optimization/114115, tree-optimization/114121, tree-optimization/114203, tree-optimization/114231, tree-optimization/114246, tree-optimization/114375, tree-optimization/114396, tree-optimization/114485, tree-optimization/114566, tree-optimization/114672, tree-optimization/114733, tree-optimization/114736, tree-optimization/114749, tree-optimization/114787, tree-optimization/114799, tree-optimization/114876, tree-optimization/114965, tree-optimization/115143, tree-optimization/115152, tree-optimization/115154 - add --without-clang-plugin --without-llvm-plugin to annobin configure options - use the system dir in --with-libstdcxx-zoneinfo (RHEL-21093) - fix for libstdc++_nonshared.a on ppc64le (RHEL-17960) - add f95 (RHEL-17655) - update from releases/gcc-13 branch - PRs c++/33799, c++/102191, c++/111703, c++/112269, c++/112301, c++/112633, c/112339, fortran/111880, fortran/112764, libgomp/111413, libstdc++/112348, libstdc++/112491, libstdc++/112607, middle-end/111497, target/53372, target/110411, target/111408, target/111815, target/111828, target/112672, tree-optimization/111137, tree-optimization/111465, tree-optimization/111967, tree-optimization/112496 - add -fno-stack-protector to aarch64 tests (RHEL-17684) - update from releases/gcc-13 branch - PRs c++/89038, c/111884, d/110712, d/112270, fortran/67740, fortran/97245, fortran/111837, fortran/112316, libbacktrace/111315, libbacktrace/112263, libstdc++/110944, libstdc++/111172, libstdc++/111936, libstdc++/112089, libstdc++/112314, middle-end/111253, middle-end/111818, modula2/111756, modula2/112110, target/101177, target/110170, target/111001, target/111366, target/111367, target/111380, target/111935, target/112443, tree-optimization/111397, tree-optimization/111445, tree-optimization/111489, tree-optimization/111583, tree-optimization/111614, tree-optimization/111622, tree-optimization/111694, tree-optimization/111764, tree-optimization/111820, tree-optimization/111833, tree-optimization/111917 - fix aarch64 RA ICE (#2241139, PR target/111528) - fix ia32 doubleword rotates (#2238781, PR target/110792) - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77605) - Rebase for GTS 14.1 release. (RHEL-76932) - Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76456) - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-760404) - Annocheck: Fix the --debug-dir option. - Annocheck: Fix corrupt warning message when unable to locate separate debug info files. - Annocheck: Remove spurious debugging messages. - Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778) - Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349) - Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296) - GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429) - Testsuite: Use configured compiler when running tests. - GCC Plugin: Fix building with gcc 15. (#32429) - Annocheck: Fix overly long debug messages. - Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail. - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries. - Annocheck: Add --enable-future to enable future fail components in normal tests. - Annocheck: Fix bug preventing the inclusion of the rpm name in reports. - Annocheck: Add more exceptions for gcc binaries. (RHEL-33365) - Annocheck: Add --skip-passes option. - Annocheck: Add exceptions for gcc binaries. (RHEL-33365) - Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797) - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411) - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS. - NVR Bump to allow rebuilding with annotation. - Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069) - BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497) - Spec File: Use correct names for the symlinks. (RHEL-53209) - Spec File: Use correct names for the symlinks. (RHEL-53209) - Spec File: Use correct names for the plugins. (RHEL-53209) - Spec File: Disable bootstrapping. (RHEL-53543) - Spec File: Use correct directory for plugin installation. (RHEL-53209) - Spec File: Disable plugin when running on wrong major version of the compiler. - Annocheck: Stop spurious assembler warnings. (RHEL-53213) - Annocheck: Stop warnings about known gaps. (RHEL-53218) - Annocheck: Fix stack realign test. (#2302427) - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77605) - Rebase for GTS 14.1 release. (RHEL-76932) - Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76456) - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-760404) - Annocheck: Fix the --debug-dir option. - Annocheck: Fix corrupt warning message when unable to locate separate debug info files. - Annocheck: Remove spurious debugging messages. - Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778) - Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349) - Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296) - GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429) - Testsuite: Use configured compiler when running tests. - GCC Plugin: Fix building with gcc 15. (#32429) - Annocheck: Fix overly long debug messages. - Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail. - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries. - Annocheck: Add --enable-future to enable future fail components in normal tests. - Annocheck: Fix bug preventing the inclusion of the rpm name in reports. - Annocheck: Add more exceptions for gcc binaries. (RHEL-33365) - Annocheck: Add --skip-passes option. - Annocheck: Add exceptions for gcc binaries. (RHEL-33365) - Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797) - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411) - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS. - NVR Bump to allow rebuilding with annotation. - Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069) - BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497) - Spec File: Use correct names for the symlinks. (RHEL-53209) - Spec File: Use correct names for the symlinks. (RHEL-53209) - Spec File: Use correct names for the plugins. (RHEL-53209) - Spec File: Disable bootstrapping. (RHEL-53543) - Spec File: Use correct directory for plugin installation. (RHEL-53209) - Spec File: Disable plugin when running on wrong major version of the compiler. - Annocheck: Stop spurious assembler warnings. (RHEL-53213) - Annocheck: Stop warnings about known gaps. (RHEL-53218) - Annocheck: Fix stack realign test. (#2302427) - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string. (RHEL-77605) - Rebase for GTS 14.1 release. (RHEL-76932) - Annocheck: Fix locating string notes (again). Add exception for glibc benchmark tests. (RHEL-76456) - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries. (RHEL-760404) - Annocheck: Fix the --debug-dir option. - Annocheck: Fix corrupt warning message when unable to locate separate debug info files. - Annocheck: Remove spurious debugging messages. - Annocheck: Always look for annobin notes in separate debug info files. (RHEL-75778) - Annocheck: Support multiple --debug-rpm and --debug-file options. (RHEL-73349) - Annocheck: Add support for sys-root'ed glibc packages. (RHEL-71296) - GCC Plugin: Tidy up use of gcc's diagnoatic headers. (#32429) - Testsuite: Use configured compiler when running tests. - GCC Plugin: Fix building with gcc 15. (#32429) - Annocheck: Fix overly long debug messages. - Annocheck: Rename rwx-seg test to load-segments. Add more checks. Add check for gaps as a future fail. - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries. - Annocheck: Add --enable-future to enable future fail components in normal tests. - Annocheck: Fix bug preventing the inclusion of the rpm name in reports. - Annocheck: Add more exceptions for gcc binaries. (RHEL-33365) - Annocheck: Add --skip-passes option. - Annocheck: Add exceptions for gcc binaries. (RHEL-33365) - Annocheck: Skip property note test for i386 binaries created by LLVM. (#2323797) - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info. (RHEL-65411) - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS. - NVR Bump to allow rebuilding with annotation. - Clang & LLVM Plugins: Include install directory in binary. (RHEL-54069) - BuiltBy: Fix seg-fault when comparing language version strings. (RHEL-53497) - Spec File: Use correct names for the symlinks. (RHEL-53209) - Spec File: Use correct names for the symlinks. (RHEL-53209) - Spec File: Use correct names for the plugins. (RHEL-53209) - Spec File: Disable bootstrapping. (RHEL-53543) - Spec File: Use correct directory for plugin installation. (RHEL-53209) - Spec File: Disable plugin when running on wrong major version of the compiler. - Annocheck: Stop spurious assembler warnings. (RHEL-53213) - Annocheck: Stop warnings about known gaps. (RHEL-53218) - Annocheck: Fix stack realign test. (#2302427) - Add missing headers arm_neon_sve_bridge.h and arm_sme.h for aarch64 (RHEL-124589) - Fix glibc32 dependency (RHEL-112209) - Fix ICE in rebuild_jump_labels on aarch64-linux-gnu (RHEL-106790) - Put the libstdc++ AS_NEEDED in the right places (RHEL-84679) - Add AS_NEEDED libstdc++.so.6 when only needed through libstdc++_nonshared (RHEL-84679) - libstdc++: Fix -Warray-bounds warning in std::vector<bool> (RHEL-90244) - disable jQuery use, don't ship jquery.js (CVE-2020-11023, RHEL-78387) - update from releases/gcc-14 branch (RHEL-74061) - PRs ada/113036, ada/113868, ada/115917, ada/117328, ada/117996, analyzer/115724, c/117641, c/117745, c/117802, c++/100358, c++/101463, c++/102594, c++/109859, c++/113108, c++/114854, c++/115008, c++/115430, c++/115657, c++/116108, c++/116634, c++/117158, c++/117317, c++/117614, c++/117615, c++/117792, c++/117825, c++/117845, c++/117880, c++/117925, c++/117985, c++/118060, c++/118069, driver/117942, fortran/84674, fortran/84869, fortran/105054, fortran/109105, fortran/109345, fortran/115070, fortran/115348, fortran/116388, fortran/117730, fortran/117763, fortran/117774, fortran/117791, fortran/117797, fortran/117819, fortran/117820, fortran/117843, fortran/117897, libgomp/117851, libstdc++/89624, libstdc++/106212, libstdc++/106676, libstdc++/108236, libstdc++/109517, libstdc++/109976, libstdc++/112349, libstdc++/112641, libstdc++/117520, libstdc++/117560, libstdc++/117822, libstdc++/117962, libstdc++/117966, libstdc++/118035, libstdc++/118093, middle-end/43374, middle-end/102674, middle-end/116997, middle-end/117433, middle-end/117458, middle-end/117459, middle-end/117847, middle-end/118024, modula2/114529, modula2/115003, modula2/115057, modula2/115164, modula2/115276, modula2/115328, modula2/115536, modula2/115540, modula2/115804, modula2/115823, modula2/115957, modula2/116048, modula2/116181, modula2/116378, modula2/116557, modula2/116918, modula2/117120, modula2/117371, modula2/117555, modula2/117660, modula2/117904, modula2/117948, other/116603, preprocessor/117118, rtl-optimization/113994, rtl-optimization/116799, rtl-optimization/117095, sanitizer/117960, target/64242, target/114801, target/114942, target/116371, target/116629, target/116999, target/117045, target/117105, target/117304, target/117357, target/117408, target/117418, target/117443, target/117500, target/117525, target/117562, target/117564, target/117642, target/117659, target/117675, target/117744, target/117926, testsuite/103298, testsuite/109360, tree-optimization/94589, tree-optimization/112376, tree-optimization/116463, tree-optimization/117142, tree-optimization/117254, tree-optimization/117307, tree-optimization/117333, tree-optimization/117398, tree-optimization/117417, tree-optimization/117439, tree-optimization/117574, tree-optimization/117594, tree-optimization/117612, tree-optimization/117912 - fix up -freport-bug default (#2330362, RHEL-70192) - revert -mearly-ldp-fusion and -mlate-ldp-fusion default to enabled on aarch64 to match upstream (RHEL-74059) - consider TARGET_EXPR invariant like SAVE_EXPR (PR c++/118509) - have gfortran require install-info (RHEL-62417) - bump NVR (RHEL-53492) - do not hide _ZSt21ios_base_library_initv - Always inline _M_extract_name (RHEL-150603) - update from releases/gcc-15 branch (RHEL-116513) - PRs ada/68179, ada/123060, ada/123088, ada/123096, ada/123138, ada/123185, ada/123289, ada/123302, ada/123306, ada/123371, ada/123589, analyzer/122975, analyzer/123085, c/123156, c++/91388, c++/114764, c++/116952, c++/120446, c++/121854, c++/121966, c++/122048, c++/122070, c++/122550, c++/122668, c++/122752, c++/122772, c++/122834, c++/122922, c++/123331, c++/123597, debug/121964, diagnostics/120063, fortran/107406, libfortran/122936, libstdc++/120446, libstdc++/122812, libstdc++/122907, libstdc++/123147, middle-end/111817, middle-end/123107, middle-end/123392, middle-end/123703, rtl-optimization/121773, rtl-optimization/122215, rtl-optimization/123121, rtl-optimization/123523, target/117575, target/119130, target/120250, target/121192, target/121485, target/123022, target/123092, target/123155, target/123217, target/123460, target/123484, target/123489, target/123521, target/123607, target/123742, testsuite/123353, tree-optimization/122793, tree-optimization/122868, tree-optimization/123040, tree-optimization/123300, tree-optimization/123351, tree-optimization/123372, tree-optimization/123431, tree-optimization/123513, tree-optimization/123602, tree-optimization/123736, tree-optimization/123741 - Fix glibc32 build dependency (RHEL-113182) - ship libstdc++.modules.json (RHEL-97095) - Add AS_NEEDED libstdc++.so.6 when only needed through libstdc++_nonshared (RHEL-94866) - configure with --enable-host-pie --enable-host-bind-now (RHEL-95564) - re-enable annobin-plugin and offload-nvptx - update from releases/gcc-15 branch - PRs ada/112958, ada/120104, c/120057, c++/119863, c++/119864, c++/119938, c++/119939, c++/119981, c++/119996, c++/120012, c++/120013, c++/120023, c++/120125, c++/120161, c++/120350, fortran/102891, fortran/102900, fortran/119928, fortran/119986, fortran/120049, fortran/120107, fortran/120139, fortran/120163, fortran/120179, fortran/120191, ipa/119852, ipa/119973, ipa/120006, ipa/120146, libfortran/120152, libfortran/120153, libfortran/120158, libfortran/120196, libstdc++/118260, libstdc++/119427, libstdc++/119714, libstdc++/120029, libstdc++/120114, libstdc++/120159, libstdc++/120187, libstdc++/120190, libstdc++/120198, libstdc++/120293, modula2/115276, modula2/119914, modula2/119915, modula2/120117, modula2/120188, preprocessor/116047, preprocessor/120061, target/119610, testsuite/119909, tree-optimization/111873, tree-optimization/119712, tree-optimization/120043, tree-optimization/120048, tree-optimization/120074, tree-optimization/120089, tree-optimization/120143, tree-optimization/120211 - update from releases/gcc-15 branch - GCC 15.1 release - PRs fortran/119836, target/119327, target/119873, tree-optimization/118407 - Fix GTS version in package name. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add condition if fedora for packages not available in RHEL - enable avif support - use bcond - rebase to version 2.3.2 - Upstream released new version 2.3.1 - patch bug615 is no more needed - fixed by upstream in release - gdimagestring16/gdimagestring16 gdimagestringup16/gdimagestringup16 passed on x390s - XFAIL_TEST definition for x390s is no more necessary - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - fix gdImageStringFT() fails for empty strings https://github.com/libgd/libgd/issues/615 - update to 2.3.0 - add dependency on libraqm - remove gdlib-config - Add patch(gd-2.2.5-null-pointer.patch) - fix Null pointer reference in gdImageClone (gdImagePtr src) - Resolves: #1599032 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix buffer overflow and use of uninitialized memory in GIF decoding (CVE-2026-9672) Related: RHEL-259613 - Backport fixes for CVE-2026-5201 - Related: RHEL-163069 - Fix an oversight - Related: RHEL-102354 - Backport fixes for CVE-2025-7345 - Resolves: RHEL-102354 - Backport fixes for CVE-2022-48622 - Resolves: RHEL-36432 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop tepl dependency Related: #1948446 - Add 40.0 release info to appdata - Filter provides for plugin .so files - Update to 40.0 - Don't use gsettings key that was removed from nautilus 40 (#1931020) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 3.38.1 - Update to 3.38.0 - New upstream release 0.4.62 (RHEL-88143) - New upstream release 0.4.58 (RHEL-88143) - Rebuild against new LibRaw soname Resolves: RHEL-770 - Fix CVE-2026-2050 (RHEL-188266) - New upstream release 0.4.62 (RHEL-88143) - New upstream release 0.4.58 (RHEL-88143) - Fix CVE-2026-18300: bounds check in rgbe_read_scanlines - Fix CVE-2026-2050: buffer overflow in rgbe_read_new_rle - Resolves: RHEL-188264 - New upstream release 0.4.62 (RHEL-88143) - New upstream release 0.4.58 (RHEL-88143) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Latest upstream - Latest upstream - Latest upstream - Add ASN subpackage - RHEL-88966 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable() - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths - RHEL-44745 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction - RHEL-44731 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass) - RHEL-38839 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library - fix for CVE-2023-43115 - Resolves: RHEL-10185 - fix for CVE-2023-38559 - Resolves: rhbz#2224372 - fix for CVE-2023-36664 - Resolves: rhbz#2217810 - RHEL-264921 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 (JPXDecode) output adapter - RHEL-88966 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable() - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - RHEL-273957 CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free via Type 5 shading OOB write and procedure-stream use-after-free - RHEL-264921 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 (JPXDecode) output adapter - RHEL-88966 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable() - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154864) - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157133) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154864) - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18302 - fix CVE-2026-18303 - fix CVE-2026-18304 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-18307 - fix CVE-2026-18308 - fix CVE-2026-42169 - fix CVE-2026-66758 - fix CVE-2026-66759 - fix CVE-2026-58380 - Resolves: RHEL-192383 - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2026-97185 - fix CVE-2026-92248 - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18302 - fix CVE-2026-18303 - fix CVE-2026-18304 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-18307 - fix CVE-2026-18308 - fix CVE-2026-42169 - fix CVE-2026-66758 - fix CVE-2026-66759 - fix CVE-2026-58380 - Resolves: RHEL-192383 - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - Bump release - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - Rebase to 3.0.2 stable version (RHEL-40106) - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - Rebase to 3.0.2 stable version (RHEL-40106) - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - Rebase to 3.0.2 stable version (RHEL-40106) - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - fix CVE-2026-42169 - fix CVE-2026-66758 - fix CVE-2026-66759 - fix CVE-2026-58380 - Resolves: RHEL-192383 - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18302 - fix CVE-2026-18303 - fix CVE-2026-18304 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-18307 - fix CVE-2026-18308 - fix CVE-2026-42169 - fix CVE-2026-66758 - fix CVE-2026-66759 - fix CVE-2026-58380 - Resolves: RHEL-192383 - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2026-97185 - fix CVE-2026-92248 - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18302 - fix CVE-2026-18303 - fix CVE-2026-18304 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-18307 - fix CVE-2026-18308 - fix CVE-2026-42169 - fix CVE-2026-66758 - fix CVE-2026-66759 - fix CVE-2026-58380 - Resolves: RHEL-192383 - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - Bump release - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - Rebase to 3.0.2 stable version (RHEL-40106) - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - Rebase to 3.0.2 stable version (RHEL-40106) - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - Rebase to 3.0.2 stable version (RHEL-40106) - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - fix CVE-2025-14424 - fix CVE-2025-14425 - fix CVE-2025-14423 - fix CVE-2025-14422 - fix CVE-2025-10920 - fix CVE-2025-10921 - fix CVE-2025-10922 - fix CVE-2025-10923 - fix CVE-2025-10924 - fix CVE-2025-10925 - fix CVE-2025-10934 - Rebase to 3.0.4 stable version and exclude s390x arch (RHEL-40106) - fix CVE-2026-42169 - fix CVE-2026-66758 - fix CVE-2026-66759 - fix CVE-2026-58380 - Resolves: RHEL-192383 - fix CVE-2026-58384 - Resolves: RHEL-192536 - fix CVE-2026-58379 - Resolves: RHEL-192170 - fix CVE-2026-4150 - align with Y-stream - fix CVE-2026-4151 - fix CVE-2026-4152 - fix CVE-2026-4153 - fix CVE-2026-4154 - fix CVE-2026-4887 - fix CVE-2026-4150 - Resolves: RHEL-167738 - bump spec - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048 - fix CVE-2025-15059 - Always initialize callback return value Resolves: #2196877 - Guard against invalid gobject property access Resolves: #2170044 - Update to 1.68.6 Resolves: #2066167 - Update to 1.68.5 Resolves: #2054085 - Update to 1.68.4 - Increate test timeouts to make it more reliable on armv7 Resolves: #2005774 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Update to 1.68.3 Resolves: #1993764 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Bundle mozjs (#1958111) - Recommends: libproxy-webkitgtk4 for glib-pacrunner - Related: #2056988 - Reenable libproxy dependency - Resolves: #2056988 - Update to 2.68.3 - Resolves: #1947187 - Update to 2.68.2 - Resolves: #1993765 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Disable libproxy in RHEL - Resolves: #1968554 - Update to 2.68.1 - Resolves: #1947188 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 2.68.0 - Update to 2.68.rc - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - remove unneeded file with ambiguous licence - fixes bug bz#1939340 - Rebase with latest RHGS-3.5.4 - Fix changlog chronological order by removing unneeded changelogs - fixes bug bz#1939340 - fixes bugs bz#1953901 - fixes bugs bz#1927235 - fixes bugs bz#1948547 - fixes bugs bz#1939372 - fixes bugs bz#1832306 bz#1911292 bz#1924044 - fixes bugs bz#1224906 bz#1691320 bz#1719171 bz#1814744 bz#1865796 - fixes bugs bz#1600459 bz#1719171 bz#1830713 bz#1856574 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - remove unneeded file with ambiguous licence - fixes bug bz#1939340 - Rebase with latest RHGS-3.5.4 - Fix changlog chronological order by removing unneeded changelogs - fixes bug bz#1939340 - fixes bugs bz#1953901 - fixes bugs bz#1927235 - fixes bugs bz#1948547 - fixes bugs bz#1939372 - fixes bugs bz#1832306 bz#1911292 bz#1924044 - fixes bugs bz#1224906 bz#1691320 bz#1719171 bz#1814744 bz#1865796 - fixes bugs bz#1600459 bz#1719171 bz#1830713 bz#1856574 - Fix: previous commit removed one function from the library and thus broke the ABI - function gmpn_preinv_divrem_1 should now not be removed Related: rhbz#2044216 - Add SIMD optimization patches for s390x (provided by the IBM) Resolves: rhbz#2044216 Fix: Integer overflow and resultant buffer overflow via crafted input Resolves: CVE-2021-43618 - Add the support for intel CET Resolves: rhbz#1977890 - Move the .hmac files to the fipscheck subfolder - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location Resolves: rhbz#1980758 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 40.1 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 40.0 - Update to 40.rc - Update to 40.beta - Drop old gcalctool obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 3.38.2 - Update to 3.38.1 - Update to 3.38.0 - Update to 40.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 40.1 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + gnome-desktop3-40.0-2 - Re-add mistakenly removed debug utilities - Update to 40.0 - Update to 40.rc - Update to 40.beta - Update to 40.alpha.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Improve reliability of the startup registration notification Resolves: RHEL-4094 - Delay startup registration notification by 30 minutes Resolves: RHEL-4094 - Use mount path in "Low disk" notification when multiple mount points have same name Related: RHEL-11910 - Add build option to disable subman plugin Related: RHEL-4092 - Make "Register System" notification launch registration dialog directly Related: RHEL-4101 - Fix default power-button-action setting for servers Related: RHEL-71937 - Fix smartcards only working when cold-plugged Related: RHEL-47261 - Fix usb-protection crash when when screensaver service is unavailable Related: RHEL-19295 - Try to start rhsm if it's not already running Related: RHEL-20449 - Fix crashers in g-s-d and control-center related to making subscription-manager a soft dep Related: RHEL-20449 - Extend workspace buttons to screen edge Resolves: RHEL-43545 - Add "move-clock" extension Resolves: RHEL-33429 - Fix downstream stylesheets Resolves: RHEL-25016 - Improve workspace previews Resolves: RHEL-25016 - Handle touch events in desktop icons Resolves: RHEL-22713 - Prefer window icons in window list Resolves: RHEL-24713 - Notify on desktop icon drags Resolves: RHEL-26989 - Hide classification banners from picks Resolves: RHEL-22789 - Handle missing main dock when restoring dash Resolves: RHEL-16723 - Include dash-to-panel extension Resolves: RHEL-14935 - Extend workspace buttons to screen edge Resolves: RHEL-43545 - Add "move-clock" extension Resolves: RHEL-33429 - Fix downstream stylesheets Resolves: RHEL-25016 - Improve workspace previews Resolves: RHEL-25016 - Handle touch events in desktop icons Resolves: RHEL-22713 - Prefer window icons in window list Resolves: RHEL-24713 - Notify on desktop icon drags Resolves: RHEL-26989 - Hide classification banners from picks Resolves: RHEL-22789 - Handle missing main dock when restoring dash Resolves: RHEL-16723 - Include dash-to-panel extension Resolves: RHEL-14935 - Resolves: #2228374 (Rebuild to move gnome-software-devel into CRB) - Resolves: #2128812 (Correct property name in GsRemovalDialog .ui file) - Resolves: #2129021 (Hide some errors in non-debug builds) - Resolves: #2066164 (Update to 41.5) - Resolves: #2054082 (Update to 41.4) - Resolves: #2048397 (Optional software repos can't be disabled) - Resolves: #2038805 (Update to 41.3) - Resolves: #2029323 (Update to 41.2) - Resolves: #2018871 (Update to 41.1) - Resolves: #2012699 (Backport changes from Fedora 35) - Add patch to mark compulsory only repos, not apps from it - Resolves: #2011176 (flathub repo can't be added through gnome-software) - Resolves: #2010660 (gs-repos-dialog: Can show also desktop applications) - Resolves: #2010353 (Optional repos cannot be disabled) - Resolves: #2010740 (Refresh on repository setup change) - Resolves: #2009063 (Correct update notifications) - Resolves: #2005770 (Update to 41.0) - Resolves: #2228374 (Rebuild to move gnome-software-devel into CRB) - Resolves: #2128812 (Correct property name in GsRemovalDialog .ui file) - Resolves: #2129021 (Hide some errors in non-debug builds) - Resolves: #2066164 (Update to 41.5) - Resolves: #2054082 (Update to 41.4) - Resolves: #2048397 (Optional software repos can't be disabled) - Resolves: #2038805 (Update to 41.3) - Resolves: #2029323 (Update to 41.2) - Resolves: #2018871 (Update to 41.1) - Resolves: #2012699 (Backport changes from Fedora 35) - Add patch to mark compulsory only repos, not apps from it - Resolves: #2011176 (flathub repo can't be added through gnome-software) - Resolves: #2010660 (gs-repos-dialog: Can show also desktop applications) - Resolves: #2010353 (Optional repos cannot be disabled) - Resolves: #2010740 (Refresh on repository setup change) - Resolves: #2009063 (Correct update notifications) - Resolves: #2005770 (Update to 41.0) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix a mistake building -compat - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Make a compat subpackage to provide the old paths to our libraries, linker script, and includes. - Update to 3.0.11 (via patches generated from git) - Plus newer upstream fixes (also via patches generated from git) - Fix shell exit failures in make - Fix .reloc section generation - Fix CHAR8 definition - Fix "make DESTDIR=..." - Change the installed .a/.o layout - Provide makefiles for consumers to use. - Make the -devel noarch since it's just headers. - Add a bunch of compatibility symlinks for the 3.0.8 filesystem layout These will go away once we've migrated everything using them in fedora to use the newer make system... - Upstream patch for efibind.h - Latest ELF constructors/destructors patch - Minor spec cleanups - Fix some minor rpmlint complaints - Pull recent patches from upstream - Add support for ELF constructors and destructors - Fix a minor licensing problem - Build on i686 - disable i686 temporarily - use both go-compilers and go-toolset on all rhel arches - update distro conditionals and go deps - go-toolset and go-compiler needed by all arches - use go-compiler for i686 and non-rhel-8 - re-enable all go_arches - temp disable i686 - use go-toolset-1.10-golang for rhel8 - build with new scl macros for go-toolset - Initial package (RHEL-29800) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 + gom-0.4-1 - Update to 0.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add OFL to License tag for DroidSansDevanagari font. Resolves: rhbz#1972027 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 20200215-8 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 20200215-6 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 20200215-5 💥 Actually rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 20200215-4 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 20200215-3 ✅ Lint, lint, lint and lint again - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to v20201206 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update 65-google-noto-cjk-fonts.conf for HK - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Add google-noto-sans-cjk-jp-fonts back - Resolves: RHEL-13738 - Update Noto CJK to Sans 2.004 and Serif 2.002 - Drop some Noto CJK Language Specific OTFs sub packages - Resolves: RHEL-13738 - Review covscan issues Resolves: #1938733 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix License tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Do not run gpm in the container (#1524034) - Two patches have been upstreamed - Better comments in spec file - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Add upstream commits for git master which contains patches 9, 10 and 11 - Add GCC10 fix - Cleanups - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 1.10.6 - Fix ray intersection bug causing picking errors in mutter Resolves: #1956294 - Rebuild with newer gobject-introspection to fix multilib conflict - Related: rhbz#1915340 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Disable neon for graphene on armv7hl - Add meson_test - Update to 1.10.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Re-enable LTO as upstream GCC target/96939 has been fixed - Disable LTO for now - Rebuilt for graphviz-ruby addition Resolves: RHEL-17134 - Fixed gvpack to run Resolves: rhbz#2029565 - Rebuilt for graphviz-ruby addition Resolves: RHEL-17134 - Fixed gvpack to run Resolves: rhbz#2029565 - Rebuilt for graphviz-ruby addition Resolves: RHEL-17134 - Fixed gvpack to run Resolves: rhbz#2029565 - Rebuilt for graphviz-ruby addition Resolves: RHEL-17134 - Fixed gvpack to run Resolves: rhbz#2029565 - Rebuilt for graphviz-ruby addition Resolves: RHEL-17134 - Fixed gvpack to run Resolves: rhbz#2029565 - Rebuilt for graphviz-ruby addition Resolves: RHEL-17134 - Fixed gvpack to run Resolves: rhbz#2029565 - Fix several important Covscan defects resolves: #1938735 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Make psutils a weak dependency - Add psutils as a runtime dependency (needed for groff -Thtml) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pdfpic.tmac to groff-base resolves: #1888370 - Use make macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 1.22.4 resolves: #1808072 - Fix several important Covscan defects resolves: #1938735 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Make psutils a weak dependency - Add psutils as a runtime dependency (needed for groff -Thtml) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pdfpic.tmac to groff-base resolves: #1888370 - Use make macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 1.22.4 resolves: #1808072 - Fix several important Covscan defects resolves: #1938735 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Make psutils a weak dependency - Add psutils as a runtime dependency (needed for groff -Thtml) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pdfpic.tmac to groff-base resolves: #1888370 - Use make macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 1.22.4 resolves: #1808072 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - Debrand for AlmaLinux - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size - Resolves: #RHEL-148310 - ppc64le/sbat: Add an sbat CSV file for ppc64le - Resolves: #RHEL-146555 - ppc64le: Pointing to the right cert after redhat-release change - Related: #RHEL-24742 - ppc/mkimage/appendedsig: Upstream code sync for alignment and sbat - Related: #RHEL-24742 - Fix several security issues about module unloading and file handling - Resolved: #RHEL-141594 - Resolves: #CVE-2025-54771 #CVE-2025-61661 - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664 - rpminspect: disable abidiff inspections - Resolves: #RHEL-106446 - appendedsig: Fix grub-mkimage with an unaligned appended signature size - Related: #RHEL-24742 - ieee1275: Upstream patches for appended signature support - Related: #RHEL-24742 - spec: Update RHEL x86_64 and aarch64 signing key to redhatsecureboot802 - Resolves: #RHEL-126136 - grubby-bls: in s390* systems, run zipl on grub cfg update event Resolves: #RHEL-106612 - Update cfg when setting a default kernel Resolves: #RHEL-106612 - Bump NVR - Related: #RHEL-61421 - grubby-bls: on PPC systems, remove petiboot's version checks - Resolves: #RHEL-61421 - On grub cfg updates, run grub2-mkconfig for Xen systems Resolves: #RHEL-50691 - Do not overwrite all vars that start with GRUB_CMDLINE_LINUX - Resolves: #RHEL-21301 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - New version Resolves: rhbz#1818181 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s (this branch had regressed to a stale pre-1.22.12 base) Resolves: RHEL-156269, RHEL-156270 - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied on top of the correct 1.22.12 base Resolves: RHEL-184477 - Apply patches for CVE-2026-3083, CVE-2026-3085 Resolves: RHEL-156267, RHEL-156266 - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606, CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776, CVE-2024-47777, CVE-2024-47778, CVE-2024-47834 - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195 - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200 - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204 - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039 - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167 - Resolves: RHEL-71189 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265 depayloaders to prevent excessive memory usage Resolves: RHEL-224162 - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s (this branch had regressed to a stale pre-1.22.12 base) Resolves: RHEL-156269, RHEL-156270 - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied on top of the correct 1.22.12 base Resolves: RHEL-184477 - Apply patches for CVE-2026-3083, CVE-2026-3085 Resolves: RHEL-156267, RHEL-156266 - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606, CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776, CVE-2024-47777, CVE-2024-47778, CVE-2024-47834 - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195 - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200 - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204 - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039 - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167 - Resolves: RHEL-71189 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239042 - Fix CVE-2026-73433: add bounds checks to FUJIFILM strd metadata parsing in avidemux to prevent unsigned integer underflow Resolves: RHEL-239060 - Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265 depayloaders to prevent excessive memory usage Resolves: RHEL-224162 - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s (this branch had regressed to a stale pre-1.22.12 base) Resolves: RHEL-156269, RHEL-156270 - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied on top of the correct 1.22.12 base Resolves: RHEL-184477 - Apply patches for CVE-2026-3083, CVE-2026-3085 Resolves: RHEL-156267, RHEL-156266 - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606, CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776, CVE-2024-47777, CVE-2024-47778, CVE-2024-47834 - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195 - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200 - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204 - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039 - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167 - Resolves: RHEL-71189 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Fix CVE-2026-18299: Use-After-Free in rtpsbcdepay Resolves: RHEL-246619 - Fix CVE-2026-18296: size validation in qtmoovrecover MRF parsing Resolves: RHEL-246558 - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246572 - Fix CVE-2026-18295: validate box sizes in qtmoovrecover to prevent heap buffer overflow (same upstream fix as CVE-2026-18296) Resolves: RHEL-246380 - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239042 - Fix CVE-2026-73433: add bounds checks to FUJIFILM strd metadata parsing in avidemux to prevent unsigned integer underflow Resolves: RHEL-239060 - Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265 depayloaders to prevent excessive memory usage Resolves: RHEL-224162 - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s (this branch had regressed to a stale pre-1.22.12 base) Resolves: RHEL-156269, RHEL-156270 - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied on top of the correct 1.22.12 base Resolves: RHEL-184477 - Apply patches for CVE-2026-3083, CVE-2026-3085 Resolves: RHEL-156267, RHEL-156266 - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606, CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776, CVE-2024-47777, CVE-2024-47778, CVE-2024-47834 - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195 - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200 - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204 - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039 - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167 - Resolves: RHEL-71189 - Rebuild to fix missing binaries due to buildsystem oversight - Rebuild for z-stream Resolves: RHEL-156272, RHEL-156273 - Apply patches for CVE-2026-3083, CVE-2026-3085 Resolves: RHEL-156272, RHEL-156273 - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540 CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546, CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599, CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606, CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776, CVE-2024-47777, CVE-2024-47778, CVE-2024-47834 - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195 - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200 - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204 - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039 - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167 - Resolves: RHEL-71189 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - 1.22.12 - Qt6 re-rebuild - 1.22.11 - Revert back to 1.22.9 (accidentally merged Rawhide to f40) - Rebuild - Resolves: RHEL-38511, RHEL-41157 - Rebuild - Resolves: RHEL-38511, RHEL-41157 - 1.22.12 - 1.22.11 - 1.22.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.22.8 - 1.22.7 - Update to 1.22.5 - Resolves: RHEL-4098 - Dummy commit to get ci to rerun - Related: RHEL-4098 - Resolves: RHEL-4130 - Resolves: RHEL-22853 - Resolves: RHEL-4098 - Stop looking for modules in cwd (CVE-2024-6655) - Resolves: RHEL-46993 - Actually reduce the height of window titlebars - Reduce the height of window titlebars - Switch stylus button order to match compositor Resolves: RHEL-146566 - Resolves: RHEL-4098 - Dummy commit to get ci to rerun - Related: RHEL-4098 - Resolves: RHEL-4130 - Resolves: RHEL-22853 - Resolves: RHEL-4098 - Stop looking for modules in cwd (CVE-2024-6655) - Resolves: RHEL-46993 - Actually reduce the height of window titlebars - Reduce the height of window titlebars - Resolves: RHEL-4098 - Dummy commit to get ci to rerun - Related: RHEL-4098 - Resolves: RHEL-4130 - Resolves: RHEL-22853 - Resolves: RHEL-4098 - Stop looking for modules in cwd (CVE-2024-6655) - Resolves: RHEL-46993 - Actually reduce the height of window titlebars - Reduce the height of window titlebars - Switch stylus button order to match compositor Resolves: RHEL-146566 - Resolves: RHEL-4098 - Dummy commit to get ci to rerun - Related: RHEL-4098 - Resolves: RHEL-4130 - Resolves: RHEL-22853 - Resolves: RHEL-4098 - Stop looking for modules in cwd (CVE-2024-6655) - Resolves: RHEL-46993 - Actually reduce the height of window titlebars - Reduce the height of window titlebars - Do not try to implement color glyphs without Pango help Resolves: RHEL-842 - Update to 4.12.3 Resolves: RHEL-842 - Ensure Wayland gets the Wayland IM context Resolves: #2087031 - Add build and test suite fix for single core VMs Related: #2062786 - Fix decrement number feature Resolves: #2062786 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 4.8.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 31.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 30.1 - Update to upstream version 29.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 33.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 33.2.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 31.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 30.1 - Update to upstream version 29.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Update to upstream version 33.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 33.2.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Update javapackages test plan to f42 - Update to upstream version 33.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 33.2.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 31.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 30.1 - Update to upstream version 29.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Update to upstream version 33.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 33.2.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Update javapackages test plan to f42 - Update to upstream version 33.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 33.2.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Enable building for ppc64le - Update guestfs-tools firstboot.bat to match virt-v2v resolves: RHEL-109521 - builder: Update link to templates to use https resolves: RHEL-94874 - mlcustomize: Remove dnf --verbose option resolves: RHEL-83200 - Fix virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-80214 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56811 - Replace Jansson with json-c resolves: RHEL-65294 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-55759 - Add support for nbd+unix:// URIs resolves: RHEL-33956 - customize: Implement --inject-blnsvr operation resolves: RHEL-36634 - Rebase to guestfs-tools 1.51.6 - Implement --key all:... resolves: RHEL-19030 - Fix crash because of off-by-one error resolves: RHEL-19062 - Fix virt-customize --chown invalid format resolves: RHEL-21899 - Enable building for ppc64le - Update guestfs-tools firstboot.bat to match virt-v2v resolves: RHEL-109521 - builder: Update link to templates to use https resolves: RHEL-94874 - mlcustomize: Remove dnf --verbose option resolves: RHEL-83200 - Fix virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-80214 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56811 - Replace Jansson with json-c resolves: RHEL-65294 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-55759 - Add support for nbd+unix:// URIs resolves: RHEL-33956 - customize: Implement --inject-blnsvr operation resolves: RHEL-36634 - Rebase to guestfs-tools 1.51.6 - Implement --key all:... resolves: RHEL-19030 - Fix crash because of off-by-one error resolves: RHEL-19062 - Fix virt-customize --chown invalid format resolves: RHEL-21899 - Enable building for ppc64le - Update guestfs-tools firstboot.bat to match virt-v2v resolves: RHEL-109521 - builder: Update link to templates to use https resolves: RHEL-94874 - mlcustomize: Remove dnf --verbose option resolves: RHEL-83200 - Fix virt-drivers fails on opensuse guest if kernel-source is installed resolves: RHEL-80214 - Rebase to guestfs-tools 1.52.2 resolves: RHEL-56811 - Replace Jansson with json-c resolves: RHEL-65294 - Reboot Windows between each firstboot script to improve reliability resolves: RHEL-55759 - Add support for nbd+unix:// URIs resolves: RHEL-33956 - customize: Implement --inject-blnsvr operation resolves: RHEL-36634 - Rebase to guestfs-tools 1.51.6 - Implement --key all:... resolves: RHEL-19030 - Fix crash because of off-by-one error resolves: RHEL-19062 - Fix virt-customize --chown invalid format resolves: RHEL-21899 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 5.3.4 - 1773690 - cups-genppdupdate doesnt work for non-utf-8 PPDs - make is no longer in buildroot by default - dont require the gimp package as build require, pkgconfig's gimpui-2.0 suffices - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix warning building with clang - non-void function 'stp_paths_copy_with_prefix' should return a value [-Wreturn-type] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 5.3.4 - 1773690 - cups-genppdupdate doesnt work for non-utf-8 PPDs - make is no longer in buildroot by default - dont require the gimp package as build require, pkgconfig's gimpui-2.0 suffices - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix warning building with clang - non-void function 'stp_paths_copy_with_prefix' should return a value [-Wreturn-type] - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - udisks2: Correct add to hash table for items which can clash in the monitor (RHEL-143934) - udisks2: Use hash table for quicker lookups in the monitor (RHEL-143934) - Add edit mode support for smb backend (RHEL-71088) - Add support for x-gvfs-trash mount option (RHEL-52353) - Backport several CVE fixes (CVE-2026-84268, CVE-2026-88924) Resolves: RHEL-252312, RHEL-257348 - udisks2: Correct add to hash table for items which can clash in the monitor (RHEL-143934) - udisks2: Use hash table for quicker lookups in the monitor (RHEL-143934) - Add edit mode support for smb backend (RHEL-71088) - Add support for x-gvfs-trash mount option (RHEL-52353) - Rebuild to trigger shipping devel package (RHEL-19019) - Rebuild to trigger shipping devel package (RHEL-19019) - Rebuild to trigger shipping devel package (RHEL-19019) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Obsolete hamcrest-core and -demo - Resolves: rhbz#1966269 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.0 - Resolves: rhbz#2307508 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Obsolete hamcrest-core and -demo - Resolves: rhbz#1966269 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.0 - Resolves: rhbz#2307508 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.16.1 Resolves: RHEL-766 - Unbreak notification icon Resolves: #2051561 - Update to 2.16.0 Resolves: #1965883 - Update to 2.16.1 Resolves: RHEL-766 - Unbreak notification icon Resolves: #2051561 - Update to 2.16.0 Resolves: #1965883 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to new upstream release 0.12.0 (#2081598) - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to new upstream release 0.11.2 (#2036738) - Update to new upstream release 0.11.0 (#2008570) - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix FTBFS with autoconf 2.70 - Update to new upstream release 0.10.1 (#1901388) - Remove BR on gcc-c++ (no longer needed) - Update to new upstream release 0.10.0 (#1891375) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to new upstream release 0.12.0 (#2081598) - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to new upstream release 0.11.2 (#2036738) - Update to new upstream release 0.11.0 (#2008570) - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix FTBFS with autoconf 2.70 - Update to new upstream release 0.10.1 (#1901388) - Remove BR on gcc-c++ (no longer needed) - Update to new upstream release 0.10.0 (#1891375) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for make macro change - Update to 3.60 - Update to 3.57 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 3.56 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 3.54 - Enable CONFIG_IEEE80211BE Resolves: RHEL-58726 - Update to version 2.11 - Fix OOB memory access in Multi-Link Operation element parsing Resolves: RHEL-194042 - Enable CONFIG_IEEE80211BE Resolves: RHEL-58726 - Update to version 2.11 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1961995 - Add gating tests from rhel-8 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add perl dependencies needed for build - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to upstream version 4.5.13 - Bootstrap build - Non-bootstrap build - Build with -release 8 for better OpenJDK 8 compatibility. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 4.5.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to upstream version 4.5.13 - Bootstrap build - Non-bootstrap build - Build with -release 8 for better OpenJDK 8 compatibility. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 4.5.14 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 4.5.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable tests failing without networking - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Disable tests failing without networking - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Disable tests failing without networking - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 12. - Update to upstream version 12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 12. - Update to upstream version 12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - linux: fix support for NUMA node0 being offline (RHEL-118677) - Resolves: RHEL-118677 - Fix CI. Related: RHEL-24804 - Bump for el9_4. Related: RHEL-24804 - Distinguish Super-space and space shortcut keys. Related: RHEL-24804 - Fix CI. Related: RHEL-24804 - Bump for el9_4. Related: RHEL-24804 - Distinguish Super-space and space shortcut keys. Related: RHEL-24804 - Resolves: RHEL-39398 ship ibus-gtk4 in RHEL 9 CRB - Resolves: RHEL-1616 Fix RESOURCE_LEAK in OpenScanHub - Resolves: RHEL-1616 Make ibus-tests to depend on ibus-libs - Resolves: RHEL-1616 Space, back-spc, enter key not working on gtk4 - Fix CI tests - Resolves: RHEL-14878 - Add ibus-hangul-sync-process-key.patch - Resolves: RHEL-14878 - Don’t index the databases in the post install - Resolves: rhbz#2047954 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove BuildRequirement of cmake-fedora - Fix build on rawhide - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - bump release number to force a rebuild with newer ibus-table >= 1.10.0 - Update to 1.8.3 - Turned cangjie 3 and 5's DYNAMIC_ADJUST to FALSE Resolves: https://github.com/definite/ibus-table-chinese/pull/14 - Add SUGGESTION_MODE = TRUE to the wubi tables Resolves: https://github.com/definite/ibus-table-chinese/pull/15 - Support pinyin mode also for stroke5 table Resolves: https://github.com/definite/ibus-table-chinese/pull/12 - Use nicer values for symbol and status prompt Resolves: https://github.com/definite/ibus-table-chinese/pull/8 - update jyutping table; add cantonyale table Resolves: https://github.com/definite/ibus-table-chinese/pull/11 - Update jyutping and cantonese tables Resolves: https://github.com/definite/ibus-table-chinese/pull/9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: rhbz#1974631 Delete ibus write-cache in scriptlet - Resolves: rhbz#1974631 Delete ibus write-cache in scriptlet - Improve CI tests and add gating.yaml - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.12.5 - Return False in _execute_command_commit_candidate_number(self, number) if number out of range - Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/21 - remove Use-from-unittest-import-mock-instead-of-just-import.patch (included upstream) - Update translations from Weblate (New translation for Sinhala (si) started) - Use “BuildRequires: appstream” only on Fedora - Remove i3 from BuildRequires - Use standard library mock - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.12.4 - Update translations from Weblate (updated es, cs, fa, pt_BR, zh_CN). zh_CN is 100% complete now. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: rhbz#1974631 Delete ibus write-cache in scriptlet - Resolves: rhbz#1974631 Delete ibus write-cache in scriptlet - Improve CI tests and add gating.yaml - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.12.5 - Return False in _execute_command_commit_candidate_number(self, number) if number out of range - Resolves: https://github.com/moebiuscurve/ibus-table-others/issues/21 - remove Use-from-unittest-import-mock-instead-of-just-import.patch (included upstream) - Update translations from Weblate (New translation for Sinhala (si) started) - Use “BuildRequires: appstream” only on Fedora - Remove i3 from BuildRequires - Use standard library mock - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.12.4 - Update translations from Weblate (updated es, cs, fa, pt_BR, zh_CN). zh_CN is 100% complete now. - Resolves: RHEL-39398 ship ibus-gtk4 in RHEL 9 CRB - Resolves: RHEL-1616 Fix RESOURCE_LEAK in OpenScanHub - Resolves: RHEL-1616 Make ibus-tests to depend on ibus-libs - Resolves: RHEL-1616 Space, back-spc, enter key not working on gtk4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: rhbz#1974636 Fix license tag - Resolves: rhbz#1974636 Delete ibus write-cache in scriptlet - Improve CI tests and add gating.yaml - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 2.11.0 - Use sensitivity feature of buttons in the setup tool tab where shortcuts are defined - Don’t let dialog action area of setup tool expand. - Improve the setup tool to make it possible to enter multi-line expansions of shortcuts - Resolves https://github.com/mike-fabian/ibus-typing-booster/issues/158 - Elide extremely long candidates in the lookup table in the middle. - If a candidate contains newlines, replace the newlines with arrows in the lookup table. - If a commit string contains new-lines, commit it in several chunks and forward Return between the chunks. - Update emoji annotations from CLDR - Put the remote icon back in emoji-picker.appdata.xml, it was a false positive by appstreamcli - Translation update from Weblate (pt_PT updated, 100% complete now) - Skip the inscript2 test cases if these transliterations are not available. - Remove gnome-desktop-testing and ibus-desktop-testing from the requires of the ibus-typing-booster-tests subpackage - Use the voikko build requires only for Fedora. They are only needed to run the voikko test cases during build. - Update to 2.10.5 - Run the voikko tests only for libvoikko version >= 4.3 - Adapt voikko test cases to the newest voikko version libvoikko-4.3-3, python3-libvoikko-4.3-3, voikko-fi-2.4-3 - Log a warning when language is “fi” and “import libvoikko” failed - Return an empty list [] in spellcheck_suggest_voikko() when libvoikko was not imported - Update emoji annotations from CLDR, switching “no” and “nb” See: https://unicode-org.atlassian.net/browse/CLDR-2698 - Remove icon in emoji-picker.appdata.xml (to avoid warnings from appstream-util and appstreamcli). - Use “BuildRequires: appstream” only on Fedora - Update to 2.10.4 - Use “from unittest import mock” instead of just “import mock”. - Update emoji annotations from CLDR - Translation update from Weblate for zh_CN (still 100% complete) - Rebase to JSS 5.7.0 - Rebase to JSS 5.7.0-beta1 - Rebase to JSS 5.6.0 - Rebase to JSS 5.6.0-alpha1 - Rebase to JSS 5.5.0 - Rebuild with side tag - Add Obsoletes/Conflicts for idm-tomcatjss - Rebuild with side tag - Rebase to JSS 5.5.0-alpha3 - Rebase to JSS 5.7.0 - Rebase to JSS 5.7.0-beta1 - Rebase to JSS 5.6.0 - Rebase to JSS 5.6.0-alpha1 - Rebase to JSS 5.5.0 - Rebuild with side tag - Add Obsoletes/Conflicts for idm-tomcatjss - Rebuild with side tag - Rebase to JSS 5.5.0-alpha3 - Rebase to JSS 5.7.0 - Rebase to JSS 5.7.0-beta1 - Rebase to JSS 5.6.0 - Rebase to JSS 5.6.0-alpha1 - Rebase to JSS 5.5.0 - Rebuild with side tag - Add Obsoletes/Conflicts for idm-tomcatjss - Rebuild with side tag - Rebase to JSS 5.5.0-alpha3 - Rebase to LDAP SDK 5.6.0 - Rebase to LDAP SDK 5.6.0-alpha1 - Rebase to LDAP SDK 5.5.0 - Rebase to LDAP SDK 5.5.0-alpha4 - Rebase to LDAP SDK 5.4.0 - Rebase to PKI 11.7.1 - Rebase to PKI 11.7.0 - Rebase to PKI 11.7.0-beta1 - Drop pki-est subpackage - Use external runtime dependencies - Rebase to PKI 11.6.0 - Rebase to PKI 11.6.0-alpha2 - Rebase to PKI 11.5.1 - Rebase to PKI 11.5.0 - RHEL-245465 CVE-2026-76561 pki-core: ExternalProcessConstraint executable allow-list - RHEL-248586 CVE-2026-80110 pki-core: ACLFilter sort order fix - Rebase to PKI 11.7.1 - Rebase to PKI 11.7.0 - Rebase to PKI 11.7.0-beta1 - Drop pki-est subpackage - Use external runtime dependencies - Rebase to PKI 11.6.0 - Rebase to PKI 11.6.0-alpha2 + iio-sensor-proxy-3.3-1 - Update to 3.3 - Resolves: rhbz#1993769 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + iio-sensor-proxy-3.1-1 - Update to 3.1 - Resolves: rhbz#1971625 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + iio-sensor-proxy-3.0-1 - Update to 3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + iio-sensor-proxy-2.8-1 - Update to 2.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild with new dovecot - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Upgrade to 20210305 (#1935535) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Upgrade to 20210116 (#1916982) - Upgrade to 20200904 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Related: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z] - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z] - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z] - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z] - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured" - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8 - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system) - RHEL-145854 Include latest fixes in python3-ipatests package - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - RHEL-141500 ipa use systemd-sysusers - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS - Resolves: RHEL-141297 Memory leaks in IPA plugins - Resolves: RHEL-141054 IPA fails to sign zone - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8 - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8 - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9] - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9] - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9] - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9] - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8] - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA - Related: RHEL-114548 Rebase Samba to the latest 4.23.x release - Resolves: RHEL-107483 ipa-ca-install fails on CA-less replica due to inadequate key usage in master certificate - RHEL-218866 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL [rhel-9.8.z] - RHEL-245474 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI [rhel-9.8.z] - RHEL-248206 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service [rhel-9.8.z] - RHEL-245627 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-9.8.z] - RHEL-240898 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-9.8.z] - RHEL-240830 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [rhel-9.8.z] - RHEL-240815 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read [rhel-9.8.z] - RHEL-240804 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read [rhel-9.8.z] - RHEL-240767 ipa-migrate tool is renaming host records & host info in automount information [rhel-9.8.z] - RHEL-238677 ipa-migrate: require Replication Administrator privilege [rhel-9.8.z] - RHEL-238674 ipa-epn: drop_privileges method is mixing uid and gid [rhel-9.8.z] - RHEL-238527 ipa env: support only simple * wildcard [rhel-9.8.z] - Related: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z] - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z] - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z] - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z] - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured" - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8 - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system) - RHEL-145854 Include latest fixes in python3-ipatests package - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - RHEL-141500 ipa use systemd-sysusers - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS - Resolves: RHEL-141297 Memory leaks in IPA plugins - Resolves: RHEL-141054 IPA fails to sign zone - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8 - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8 - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9] - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9] - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9] - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9] - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8] - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA - Related: RHEL-114548 Rebase Samba to the latest 4.23.x release - Resolves: RHEL-132941 - iperf3 broken once "--logfile" is specified on server side - Resolves: RHEL-136179 - iperf Heap Buffer Overflow (CVE-2025-54349) - Resolves: RHEL-72933 - Denial of Service in iperf Due to Improper JSON Handling - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used - Resolves: RHEL-39975 - possible denial of service - Resolves: RHEL-236176 - Add JSON value checks for get_parameters (CVE-2026-71217) - Resolves: RHEL-151875 - authentication no longer works with the new openssl - Resolves: RHEL-132941 - iperf3 broken once "--logfile" is specified on server side - Resolves: RHEL-136179 - iperf Heap Buffer Overflow (CVE-2025-54349) - Resolves: RHEL-72933 - Denial of Service in iperf Due to Improper JSON Handling - Resolves: RHEL-151875 - authentication no longer works with the new openssl - Resolves: RHEL-132941 - iperf3 broken once "--logfile" is specified on server side - Resolves: RHEL-136179 - iperf Heap Buffer Overflow (CVE-2025-54349) - Resolves: RHEL-72933 - Denial of Service in iperf Due to Improper JSON Handling - Resolves: RHEL-29579 - vulnerable to marvin attack if the authentication option is used - Resolves: RHEL-39975 - possible denial of service - iproute-6.17.0-2.el9 - iproute-6.17.0-1.el9 - iproute-6.14.0-2.el9 - iproute-6.14.0-1.el9 - image-mode: double test duration - Add image-mode testing - Add tmt test plan - Fix gating yaml - iproute-6.11.0-1.el9 - Fix Obsoletes: and changelog versioning - Add ARM 64 EFI artifacts [yselkowi] (bz 2059349) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - ipxe-Add-ping-command-support.patch [bz#1985658] - ipxe-Add-VLAN-tagging-support.patch [bz#1985658] - ipxe-netdevice-Strip-802.Q-VLAN-0-priority-tags.patch [bz#1985658] - ipxe-Provide-snponly.efi-rom.patch [bz#1985658] - ipxe-Build-hwcert-subpackage.patch [bz#1985658] - Resolves: bz#1985658 (carry forward rhel8 ipxe packaging changes) - ipxe-Disable-SHA-1.patch [bz#1935932] - ipxe-Replace-genisoimage-with-xorriso.patch [bz#1971981] - ipxe-spec-Drop-disabled-efi-ia32-build-infrastructure.patch [bz#1980138] - ipxe-spec-Generate-qemu-compatible-rom-filenames.patch [bz#1980138] - Resolves: bz#1935932 (ipxe implements and/or uses the deprecated SHA-1 algorithm by default () - Resolves: bz#1971981 (Please replace genisoimage with xorriso) - Resolves: bz#1980138 (install qemu rom symlinks so qemu doesn't have to) - ipxe-Skip-some-QEMU-ROMs-when-building-for-RHEL.patch [bz#1956931] - ipxe-spec-combine-BIOS-and-EFI-roms-using-util-catrom.pl.patch [bz#1957246] - Resolves: bz#1956931 (ipxe-roms-qemu list: Clean out old ROMs) - Resolves: bz#1957246 (boot vm from pxe failed) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to newer git snapshot, synced with qemu.git - Re-enable HTTPS support, with edk2 fix included (bz 1820836) - Workaound fatal GCC 9 compilation/link errors - Fix conditionals for perl BuildRequires - Open-iSCSI upstream 2.1.11 - rebase to upstream 2.1.9+ with iscsiuio 0.7.8.8 - new meson build system, sync with fedora packaging - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix regression in fw and static node records - Open-iSCSI upstream 2.1.11 - #1934951 remove DSA/SHA-1 based authentication support - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - update to 0.101 - bz#1958038 disabled Werror, which fixes the build with OpenSSL 3 while still using deprecated functions - setup new upstream tests as gating - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - rebase to upstream v0.100 + patches from git - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2026-55995: prevent double-free in attrs.c error paths - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add make to BuildRequires - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Fix placement of several iwlwifi files in iwl*-firmware - Correct changelog dates Resolves: RHEL-128087 - Fix duplicate iwlwifi files in iwl*-firmware and linux-firmware packages Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.1.3 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.1.2 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.1.3 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.1.2 - Reduce dependencies - Initial build - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix bundle manifest - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Re-add provides on glassfish-annotation-api - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove duplicate aliases - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix bundle manifest - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Re-add provides on glassfish-annotation-api - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove duplicate aliases - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.1.3 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.1.2 release - Rebuild - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.1.3 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.1.2 release - Rebuild - Set javac source and target to 1.8 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Re-add provides on glassfish-servlet-api - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Correct mvn_file macro invokation - Add compat symlink for packages constructing the classpath manually. - Also ship the API in the old javax namespace to aid transition - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Re-add provides on glassfish-servlet-api - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Correct mvn_file macro invokation - Add compat symlink for packages constructing the classpath manually. - Also ship the API in the old javax namespace to aid transition - Initial package renamed from glassfish-servlet-api. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Re-add provides on glassfish-servlet-api - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Correct mvn_file macro invokation - Add compat symlink for packages constructing the classpath manually. - Also ship the API in the old javax namespace to aid transition - Update javapackages test plan to f42 - Switch to new GitHub repository - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Ensure CC env variable is set during build - Make javadoc subpackage noarch - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 2.4.0 - Install native artifact into a fixed location - Related: rhbz#1994935 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Version 2.3.3 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973738 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuild - Rebuild - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Ensure CC env variable is set during build - Make javadoc subpackage noarch - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 2.4.0 - Install native artifact into a fixed location - Related: rhbz#1994935 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Version 2.3.3 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973738 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Ensure CC env variable is set during build - Make javadoc subpackage noarch - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to 2.14 Related: rhbz#2001066 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.13.1 (#1831402) - Fix docs build failures with Sphinx 3 (#1823532) - Use make macros: https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Set OpenJDK version to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Set OpenJDK version to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Set OpenJDK version to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Drop explicit requires on javapackages-tools - Avoid unexpanded macro in package %description - Adjust bootstrap build for javapackages-bootstrap update - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Drop explicit requires on javapackages-tools - Avoid unexpanded macro in package %description - Adjust bootstrap build for javapackages-bootstrap update - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Drop explicit requires on javapackages-tools - Avoid unexpanded macro in package %description - Adjust bootstrap build for javapackages-bootstrap update - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Drop explicit requires on javapackages-tools - Avoid unexpanded macro in package %description - Adjust bootstrap build for javapackages-bootstrap update - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Update javapackages test plan to f42 - Avoid unexpanded macro in package %description - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Version 3.1.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Bootstrap using javapackages-bootstrap - Update javapackages test plan to f42 - Avoid unexpanded macro in package %description - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Version 3.1.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Bootstrap using javapackages-bootstrap - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Update to 3.26.3, closes rhbz#2267732 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Update to upstream version 3.25.8, closes rhbz#2252668 - Upstream removed plugin coveralls-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Update to upstream version 3.25.6, resolves rhbz#2192489 - Update to 3.26.3, closes rhbz#2267732 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Update to upstream version 3.25.8, closes rhbz#2252668 - Upstream removed plugin coveralls-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Update to upstream version 3.25.6, resolves rhbz#2192489 - Initial build - Update to upstream version 4.0.2 - Update licenses - Initial build - Initial build - Reduce dependencies, reorganize subpackages - Initial build - Reduce dependencies, reorganize subpackages - Initial build - Reduce dependencies, reorganize subpackages - Initial build - Initial build - Initial build - Update to upstream version 4.0.2 - Update licenses - Initial build - Rebuilt for RHEL-9.2.0 - Resolves: #2121499 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix JDK11 build by adding dependency for javax.xml.bind. - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 4.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with OpenJDK 8 - Remove dependency on javaparser and exec-maven-plugin - Disable tests - Update to 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to latest upstream version - Obsolete sub-packages that cannot be built on JDK 11 - Patch for javaparser API changes - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 4.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bug 1981014 - jdeparser: FTBFS due to access to internal class sun.reflect.Reflection - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Force Java 8 as sun.reflect.Reflection is removed in Java 11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild as part of revival process - BZ#1758686 - Update Java source/target to 1.8 - Fix unexpected permissions of regular files - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Update Java source/target to 1.8 - Fix unexpected permissions of regular files - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add commons-lang3 dependency for tests. - Resolves: RHBZ#1981024 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Set javac source and target to 1.8 to fix Java 11 builds. - Remove one test case that is harmlessly broken with Java 11. - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add commons-lang3 dependency for tests. - Resolves: RHBZ#1981024 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Set javac source and target to 1.8 to fix Java 11 builds. - Remove one test case that is harmlessly broken with Java 11. - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Fix compilation with Java 11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add P100: Fixes CVE-2021-33813 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Fix compilation with Java 11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add P100: Fixes CVE-2021-33813 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Fix compilation with Java 11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add P100: Fixes CVE-2021-33813 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Drop log4j12 dependency and switch junit module to log4j 1.2 API shim. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Set javac source and target to 1.8 to fix Java 11 builds. - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Drop optional isorelax verifier support from contrib. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add patches to address DoS security vulnerability - Resolves CVE-2021-33813 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Drop log4j12 dependency and switch junit module to log4j 1.2 API shim. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Drop log4j12 dependency and switch junit module to log4j 1.2 API shim. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Set javac source and target to 1.8 to fix Java 11 builds. - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Drop optional isorelax verifier support from contrib. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add patches to address DoS security vulnerability - Resolves CVE-2021-33813 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Drop log4j12 dependency and switch junit module to log4j 1.2 API shim. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Remove unused sources - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Remove unused sources - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add junit to BR - Set correct compat. value also to ant parameters - Resolves: rhbz#2162040 - Fix compatibility with Java 8 - Resolves: rhbz#2162040 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build without reflections optional dependency (#1954987) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - update to 4.0.7 tagged upstream community sources, see CHANGELOG - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - change webpack hash function to sha256 - remove unused cryptographic implementations - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - initial version - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Update to 1.6.6 - Update to 1.6.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.6.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.6.0 - Update to 1.5.2 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.18.1 - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.17.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build with default JDK 17 - Unretire with version 1.16.1 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.18.1 - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.17.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build with default JDK 17 - Unretire with version 1.16.1 - Update javapackages test plan to f42 - Use xpath macros instead of sed - Replace CC-BY-2.5 annotations with Apache-2.0 ones - Resolves: rhbz#2301569 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuild a properly versioned package - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Use xpath macros instead of sed - Replace CC-BY-2.5 annotations with Apache-2.0 ones - Resolves: rhbz#2301569 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update javapackages test plan to f42 - Use xpath macros instead of sed - Replace CC-BY-2.5 annotations with Apache-2.0 ones - Resolves: rhbz#2301569 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuild a properly versioned package - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add base and extra subpackage web fonts for Design Team - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 7.210 - Minor conditional tweaks for ELN - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add base and extra subpackage web fonts for Design Team - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 7.210 - Minor conditional tweaks for ELN - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add base and extra subpackage web fonts for Design Team - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 7.210 - Minor conditional tweaks for ELN - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add base and extra subpackage web fonts for Design Team - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 7.210 - Minor conditional tweaks for ELN - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add alias for junit-dep - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.13.1 - Bump release to account for previously untagged 4.13-1.fc33 build. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.13.2 - Change packaging to jar instead of bundle - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add alias for junit-dep - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.13.1 - Bump release to account for previously untagged 4.13-1.fc33 build. - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.13.2 - Change packaging to jar instead of bundle - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Bump Java compiler source/target levels to 1.7 - Add alias for junit-dep - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.13.1 - Bump release to account for previously untagged 4.13-1.fc33 build. - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Port to OpenJDK 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.13.2 - Change packaging to jar instead of bundle - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update javapackages test plan to f42 - Disable asciidoc generation - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - Update to upstream version 5.10.2 - Update to upstream version 5.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 5.8.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 5.7.1 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 5.7.0. - Update javapackages test plan to f42 - Disable asciidoc generation - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - Update to upstream version 5.10.2 - Update to upstream version 5.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.10.0 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 5.8.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 5.7.1 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 5.7.0. - Update javapackages test plan to f42 - Disable asciidoc generation - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - Update to upstream version 5.10.2 - Update to upstream version 5.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.10.0 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 5.8.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 5.7.1 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 5.7.0. - Drop unneeded obsoletes - Update to upstream version 1.3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.3.2 - Obsolete javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.3.1 - Update to upstream version 1.3.0 - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1961996 - Fix the syntax for path_prefix in tests.yml - Resolves:rhbz#1961996 - Add gating tests - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Convert to new fonts packaging guidelines (rh#1828983) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171590 RHEL-171596 - krad: packet ID fetched from uninitialized variable Resolves: RHEL-145355 - Create sub-package for xrealmauthz KDC plugin Resolves: RHEL-67468 - Improving kerberos ulog resize efficiency Resolves: RHEL-145359 - Do not block HMAC-MD4/5 in FIPS mode Resolves: RHEL-88704 - Don't issue RC4 session keys by default (CVE-2025-3576) Resolves: RHEL-88048 - Add PKINIT paChecksum2 from MS-PKCA v20230920 Resolves: RHEL-82647 - Add dedicated tests sub-package - Prevent overflow when calculating ulog block size (CVE-2025-24528) Resolves: RHEL-76759 - Support PKCS11 EC client certs in PKINIT Resolves: RHEL-74374 - kdb5_util: fix DB entry flags on modification Resolves: RHEL-56059 - Add ECDH support for PKINIT (RFC5349) Resolves: RHEL-4902 - libkrad: implement support for Message-Authenticator (CVE-2024-3596) Resolves: RHEL-55423 - Fix various issues detected by static analysis Resolves: RHEL-58216 - Remove RSA protocol for PKINIT Resolves: RHEL-15323 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message token handling Resolves: RHEL-45402 RHEL-45392 Rebase to 1.28 for startup and performance fixes threads: add config check to match min value with pong timeouts rx: allow links to be active faster links: fix ping interval and pong timeout value checking crypto: Try crypt and decrypt on crypto_init tx: Remove expensive memsets log: Add a TRACE log level Resolves: #RHEL-11787 Rebase to 1.25 for PMTUd fixes Resolves: rhbz#2161168 - Fix libnozzle tests failing & covscan warning on api_knet_handle_new test Resolves: rhbz#2024090 - Rebase to 1.24 Resolves: rhbz#2024090 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to new upstream version. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to new upstream version. - Update to new upstream version. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Fixes CVE-2026-11822 - Resolves: RHEL-218273 - Fixes CVE-2026-11824 - Resolves: RHEL-218281 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Make gnuplot build dependency optional, used only by tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.80.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.79.0 - Adding a timeout for TLS close - Resolves: RHEL-113471 - "cannot seek on data source" in TLS lftp sessions - Do not wait for server close-notify on TLS close - Resolves: RHEL-100406 - Improve fix for close of TLS connection - Resolves: RHEL-90997 - Ensure proper closing of TLS connection - Resolves: RHEL-90997 - Update to upstream 2.9 tarball - Update to changing SONAME (libabigail.so.8.0.0) - Simplify the %check section - Resolves: RHEL-121666 - Rebuild for c9s - Resolves: RHEL-102573 - Update to upstream 2.8 tarball - Update to changing SONAME (libabigail.so.7.0.0) - Update to upstream 2.7 tarball - Add binutils-devel as buildrequire to potentially enable the CTF backend. This will allow the enabling of the CTF backend for binutils-devel > 2.35.2 - Update to changing SONAME (libabigail.so.6.0.0) - Add --enable-ctf to the configure command line - Update to upstream 2.6 tarball - Update to changing SONAME (libabigail.so.5.0.0) - Add BuildRequires xxhash-devel - Disable abidb as its dependencies are not present in RHEL 9.6 - Resolves https://issues.redhat.com/browse/RHEL-64069 - Update to upstream 2.5 tarball - Drop patches (as they are now upstream): 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch 0002-suppression-Add-has_strict_flexible_array_data_membe.patch - Add BuildRequires: python3-devel - Remove BuildRequires: %{_bindir}/python3 - Fix SPDX Licensing string - Apply patch: 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch Resolves: https://issues.redhat.com/browse/RHEL-16614 - Apply patch: 0002-suppression-Add-has_strict_flexible_array_data_membe.patch Resolves: https://issues.redhat.com/browse/RHEL-16629 - Add git as a build requirement as we need git to apply the patches aboves that apply binaries. - Use %autosetup to handle applying the patches using git. - autoreconf after the patches touched at least one Makefile.am file. - Update to upstream 2.9 tarball - Update to changing SONAME (libabigail.so.8.0.0) - Simplify the %check section - Resolves: RHEL-121666 - Rebuild for c9s - Resolves: RHEL-102573 - Update to upstream 2.8 tarball - Update to changing SONAME (libabigail.so.7.0.0) - Update to upstream 2.7 tarball - Add binutils-devel as buildrequire to potentially enable the CTF backend. This will allow the enabling of the CTF backend for binutils-devel > 2.35.2 - Update to changing SONAME (libabigail.so.6.0.0) - Add --enable-ctf to the configure command line - Update to upstream 2.6 tarball - Update to changing SONAME (libabigail.so.5.0.0) - Add BuildRequires xxhash-devel - Disable abidb as its dependencies are not present in RHEL 9.6 - Resolves https://issues.redhat.com/browse/RHEL-64069 - Update to upstream 2.5 tarball - Drop patches (as they are now upstream): 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch 0002-suppression-Add-has_strict_flexible_array_data_membe.patch - Add BuildRequires: python3-devel - Remove BuildRequires: %{_bindir}/python3 - Fix SPDX Licensing string - Apply patch: 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch Resolves: https://issues.redhat.com/browse/RHEL-16614 - Apply patch: 0002-suppression-Add-has_strict_flexible_array_data_membe.patch Resolves: https://issues.redhat.com/browse/RHEL-16629 - Add git as a build requirement as we need git to apply the patches aboves that apply binaries. - Use %autosetup to handle applying the patches using git. - autoreconf after the patches touched at least one Makefile.am file. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - Add gating configuration (needs a new build) - Initial RHEL packaging based on Fedora package with rpmautospec disabled, disabled documentation (no gi-docgen in RHEL 9) and downstream patch to be able to compile with glib2 2.68 (thanks to Milan Crha) - Resolves: RHEL-3234 - Add gating configuration (needs a new build) - Initial RHEL packaging based on Fedora package with rpmautospec disabled, disabled documentation (no gi-docgen in RHEL 9) and downstream patch to be able to compile with glib2 2.68 (thanks to Milan Crha) - Resolves: RHEL-3234 - 1.4.2 Resolves: bz#2175754 - Bump build to build against correct Qt version Resolves: bz#2061416 - Rebuild (Qt 5.15.3) Resolves: bz#2061416 - 1.4.1 Resolves: bz#2023181 - 1.4.0 Resolves: bz#1968275 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Backport a patch from upstream to fix handling unknown tags in AppStream metadata - Resolves: #RHEL-34564 - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fixed error while loading shared libraries in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1895921 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1895921 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - tests: Adjust sizes in generic FS resize test for VFAT resize Resolves: RHEL-124142 - lvm-dbus: Fix calling lvcreate with empty list of PVs Resolves: RHEL-113928 - Don't allow suid and dev set on fs resize Resolves: RHEL-96039 - crypto: Add a function to set persistent flags for LUKS Resolves: RHEL-82886 - nvme: Add bd_nvme_is_tech_avail to the API file Resolves: RHEL-59588 - tests: Remove unreliable nvme attribute checks Resolves: RHEL-16126 - lvm: Add support for starting and stopping VG locking Resolves: RHEL-15921 - nvme: HostID fixes for TP4126 Resolves: RHEL-1375 - nvme: Stack smashing fixes Resolves: RHEL-13127 Resolves: RHEL-8037 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Translated using Weblate (Hebrew) (sh.yaron) - Added translation using Weblate (Hebrew) (sh.yaron) - Add support to ppc64le for debian build (74309971+gururajrkatti) - Translated using Weblate (Finnish) (ricky.tigg) - tools: Read input from stdin when not running in a tty (vtrefny) - travis: Print logs after failed tests (vtrefny) - tests: Run pylint and pycodestyle on bscalc (vtrefny) - bscalc: Add option to print only single "human readable" result (vtrefny) - travis: Add --nogpgcheck when using dnf on Fedora (vtrefny) - Translated using Weblate (Asturian) (fitoschido) - Update translation files (noreply) - Translated using Weblate (Spanish) (fitoschido) - Sync spec with downstream (vtrefny) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add Travis build status badge (vtrefny) - Add Travis CI config and Dockerfiles for running tests (vtrefny) - Add ansible playbook for installing test dependencies (vtrefny) - remove msgcat dependency (Aduskett) - Translated using Weblate (Bengali (India)) (akarshan.biswas) - Update translation files (noreply) - Added translation using Weblate (Bengali (India)) (akarshan.biswas) - Fix library version in pkgconfig file (vtrefny) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for Python 3.9 - Fix memory leak in bs_size_new_from_str (vtrefny) - Translated using Weblate (Turkish) (oguzersen) - add translation platform widget (jean-baptiste) - Update translation files (noreply) - Do not regenerate POT file during 'make release' (vtrefny) - Remove Zanata from our build and release processes (vtrefny) - Add PO files to git (vtrefny) - Sync spec with downstream (vtrefny) - Require the same version of python3-bytesize in libbytesize-tools (v.podzimek) - src/gettext: fix warning if gettext is already present (giulio.benetti) - Update README.md (vpodzime) - fix build on shells where test == fails (tbier) - Add POT file to git and do not rebuild it during every build (vtrefny) - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169312 - Fix typos in the cap_from_text.3 man page Resolves: RHEL-1838 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Avoid hardcoding man page extension - update to 0.7.0 Resolves: rhbz#1813738 Resolves: rhbz#1863978 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix FTBFS, add version for soname, minor cleanups - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for removed libstdc++ symbol (#1937698) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for Boost 1.73 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for removed libstdc++ symbol (#1937698) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for Boost 1.73 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - resolves: rhbz#1915369 - Split out a cmocka-doc package - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Correctly build with new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable LTO - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 0.1.18 - Don't print empty requires - Remove Python 2 support - Fix issues detected by static analyzers - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.1.16 - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343) - Fix memory leaks and resource leaks - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - spec: Fix building with new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Adress rpminspect issue - missing debuginfo for db_converter - Use a fixed path, /usr/lib64/libc.so.6 for 64-bit targets - Rebase db_converter tool to the latest version - Add db_converter into -utils subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Resolves: RHEL-35607 - Adress rpminspect issue - missing debuginfo for db_converter - Use a fixed path, /usr/lib64/libc.so.6 for 64-bit targets - Rebase db_converter tool to the latest version - Add db_converter into -utils subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Resolves: RHEL-35607 - Adress rpminspect issue - missing debuginfo for db_converter - Use a fixed path, /usr/lib64/libc.so.6 for 64-bit targets - Rebase db_converter tool to the latest version - Add db_converter into -utils subpackage - It allowes to convert BerkeleyDB database format to GDBM/LMDB format - Resolves: RHEL-35607 - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-148462 ("Improve multipathd's handling of updating persistent reservations on restored paths. [rhel-9]") - Resolves: RHEL-148462 - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd [rhel-9]") - Resolves: RHEL-141291 - Add 0198-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133814 ("log_checker_err is not printing messages repeatedly for failed path [rhel-9]") - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error "Could not open '/dev/dm-95': No such file or directory") - Resolves: RHEL-133814 - Resolves: RHEL-135904 - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat storage [rhel-9]") - Resolves: RHEL-128396 - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0161-limpathpersist-redesign-failed-release-workaround.patch - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0167-libmultipath-rename-prflag_value-enums.patch - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103109 ("Update multipath builtin config to add new device defaults") - Resolves: RHEL-103109 - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82534 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82534 - Add 0140-multipath-clean-up-find_multipaths-value-names.patch - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd to communicate with a process in another network namespace") - Fix multipath_conf_syntax OSCI test. - Resolves: RHEL-82307 - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a process in another network namespace") - Resolves: RHEL-78758 - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-148462 ("Improve multipathd's handling of updating persistent reservations on restored paths. [rhel-9]") - Resolves: RHEL-148462 - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd [rhel-9]") - Resolves: RHEL-141291 - Add 0198-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133814 ("log_checker_err is not printing messages repeatedly for failed path [rhel-9]") - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error "Could not open '/dev/dm-95': No such file or directory") - Resolves: RHEL-133814 - Resolves: RHEL-135904 - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat storage [rhel-9]") - Resolves: RHEL-128396 - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0161-limpathpersist-redesign-failed-release-workaround.patch - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0167-libmultipath-rename-prflag_value-enums.patch - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118515 ("There are many bugs in multipath's persistent reservation handling") - Resolves: RHEL-118515 - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103109 ("Update multipath builtin config to add new device defaults") - Resolves: RHEL-103109 - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82534 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82534 - Add 0140-multipath-clean-up-find_multipaths-value-names.patch - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd to communicate with a process in another network namespace") - Fix multipath_conf_syntax OSCI test. - Resolves: RHEL-82307 - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a process in another network namespace") - Resolves: RHEL-78758 - Rebuilt for CRB inclusion Resolves: RHEL-135108 - Rework the selection of functions to represent in BTF, for instance: - Skip functions that passes values thru the stack when those structs don't have expected alignment due to some attribute usage that then causes problems with BTF trampolines due to lack of expressiveness in BTF to signal such special cases. - Skip objects (compile units) without DWARF: don't stop a multi object encoding session just because one doesn't have any DWARF in it. - Fix BTF dedup by updating libbpf. - Fix the inference of the explicit alignment attribute of zero length arrays, like struct skb_ext->data[] in the Linux kernel. Important as BTF has no no explicit alignment attribute encoding. - Fix the inference of alignments after bitfields, such as in struct nft_rule_dp->data[] after ->handle:42, also in the Linux kernel. - Fix segfault with --show_reorg_steps option, e.g. pahole -R -S -C task_struct. - Add comparision of functions encoded in BTF between baseline 'master' branch and current branch, i.e. 'next'. - New release: 1.30 - Better detection of abort during DWARF loader thread processing - pahole now detects presence of libbpf APIs and BTF features using weak function declarations when built using a shared library libbpf - Type tags are emitted for BPF arena pointers with new BTF "attributes" feature - New release: 1.29 - Multithreading is now in the DWARF loader using a jobs queue and a pool of worker threads. - The BTF encoding now is always reproducible, and as fast/faster than before. - The memory consumption is reduced. - Support for multiple BTF_DECL_TAGs pointing to same tag. - Verify that pfunct prints btf_decl_tags read from BTF. - Don't print functions twice when using 'pfunct -f function_name'. - New release: 1.28 - Various improvements to reduce the memory footprint of pahole, notably when doing BTF encoding. - Show flexible arrays statistics - Add '--padding N' and '--padding_ge N' to show structs with paddings - Introduce --running_kernel_vmlinux to find a vmlinux that matches the build-id of the running kernel. - Don't stop pfunct output at the first function that matches a filter, show all of them - Allow encoding data about all global variables, not just per CPU ones - Handle .BTF_ids section endianness, fully supporting cross builds - Generate decl tags for bpf_fastcall for eligible kfuncs - Add "distilled_base" BTF feature to split BTF generation. - Use the ELF_C_READ_MMAP mode with libelf, reducing peak memory utilization - Allow overriding /sys/kernel/btf/vmlinux via the PAHOLE_VMLINUX_BTF_FILENAME env var - Allow setting the list of compile units via PAHOLE_LANG_EXCLUDE env var - Serialize access to elfutils dwarf_getlocation(). - Honour --lang_exclude when merging LTO built CUs. - Add the debuginfod client cache directory to the vmlinux search path. - Print the CU's language when a tag isn't supported. - Initial support for GNU_formal_parameter_pack, GNU_template_parameter_pack, template_value_param and template_type_param DWARF tags. - Improve the parameter parsing by checking DW_OP_[GNU_]entry_value - Introduce a tests/ directory with regression tests - Backport upstream bugfixes for clang builds Resolves: RHEL-54022 - Resolves: RHEL-30780 - New release: v1.26 - When expanding types using 'pahole -E' do it for union and struct typedefs and for enums too. - Print number of holes, bit holes and bit paddings in class member types. - Introduce --contains_enumerator=ENUMERATOR_NAME: - Fix pretty printing using DWARF, waiting for a CU with both class (-C) and a specified "type_enum". - Add support for DW_TAG_constant in the DWARF loader, first seen in Go DWARF. - Fix loading DW_TAG_subroutine_type generated by the Go compiler. - Fix loading of 32-bit signed enums from BTF. - Add 'pahole --btf_features' to allow consumers to specify an opt-in set of features they want to use in BTF encoding. - Parallelize loading BTF and DWARF, speeding up a bit btfdiff. - Do type expansion to cover "private" types and enumerations in btfdiff. - New release: v1.27 - Reproducible parallel builds: multiple runs with different number of loading/encoding threads produce the same result. - Inject kfunc decl tags into BTF from the BTF IDs ELF section in the Linux kernel vmlinux file. - Sanitize unsupported DWARF int type with greater-than-16 byte, as BTF doesn't support it. - Initial support for BTF_KIND_DECL_TAG in the BTF loader, adding support in pfunct output. - Fix hole discovery with inheritance in C++. - Avoid double-free memory corruption. Resolves: RHEL-130877 - Fix static analyzer detected issues. Resolves: RHEL-24989 - Add libeconf-devel to a public repo. Resolves: RHEL-126957 - Avoid double-free memory corruption. Resolves: RHEL-130877 - Fix static analyzer detected issues. Resolves: RHEL-24989 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - bump NVR to trigger CI - add gating test that uses acd-client.c. Related: rhbz#1973511 - drop tests dependency on libell-devel. Related: rhbz#1973511 - Avoid use of inet_ntoa(). Related: rhbz#1967524 - Update to 0.41. Related: rhbz#1967524 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.39 - Update to 0.38 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.36 - Update to 0.35 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - new upstream release - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - fix build with latest boost - add fix for contemporary glm - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - new upstream release - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - fix build with latest boost - add fix for contemporary glm - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - add -devel subpackage into CRB - Resolves: RHEL-38617 - add -devel subpackage into CRB - Resolves: RHEL-38617 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libevdev 1.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - libevdev 1.10.1 - libevdev 1.10.0 - libevdev 1.10 rc2 - libevdev 1.10 rc1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - libevdev 1.9.1 - this time with sources - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix CVE-2020-0181, CVE-2020-0198, and CVE-2020-0452 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 0.6.22 - .spec cleanup - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix integer underflow in MakerNote decoding (CVE-2026-40386) - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385) Resolves: RHEL-170253, RHEL-170234 - Ship libexttextcat-devel in CRB Resolves: RHEL-126949 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Re-work flex subpackages and provide shared libraries (#1327851): - Remove and obsolete the flex-devel subpackage containing static libraries - Provide shared libraries in a new subpackage named libfl2 - Provide development files in a new subpackage named libfl-devel - Provide static libraries in a new subpackage named libfl-static - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Re-work flex subpackages and provide shared libraries (#1327851): - Remove and obsolete the flex-devel subpackage containing static libraries - Provide shared libraries in a new subpackage named libfl2 - Provide development files in a new subpackage named libfl-devel - Provide static libraries in a new subpackage named libfl-static - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1895921 replace apache-commons-logging with java.util.logging - remove itext patch from source zip - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1895921 replace apache-commons-logging with java.util.logging - remove itext patch from source zip - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1963838 restore missing functions Remove ant-contrib support dropped compile.res_copy target so .properties files didn't get included in the jar so libformula didn't use its built-in loaders so libreoffice's database report generator didn't show all categories in formula wizard - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1895921 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1963838 restore missing functions Remove ant-contrib support dropped compile.res_copy target so .properties files didn't get included in the jar so libformula didn't use its built-in loaders so libreoffice's database report generator didn't show all categories in formula wizard - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1895921 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.3.2 upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Always inline _M_extract_name (RHEL-150603) - update from releases/gcc-15 branch (RHEL-116513) - PRs ada/68179, ada/123060, ada/123088, ada/123096, ada/123138, ada/123185, ada/123289, ada/123302, ada/123306, ada/123371, ada/123589, analyzer/122975, analyzer/123085, c/123156, c++/91388, c++/114764, c++/116952, c++/120446, c++/121854, c++/121966, c++/122048, c++/122070, c++/122550, c++/122668, c++/122752, c++/122772, c++/122834, c++/122922, c++/123331, c++/123597, debug/121964, diagnostics/120063, fortran/107406, libfortran/122936, libstdc++/120446, libstdc++/122812, libstdc++/122907, libstdc++/123147, middle-end/111817, middle-end/123107, middle-end/123392, middle-end/123703, rtl-optimization/121773, rtl-optimization/122215, rtl-optimization/123121, rtl-optimization/123523, target/117575, target/119130, target/120250, target/121192, target/121485, target/123022, target/123092, target/123155, target/123217, target/123460, target/123484, target/123489, target/123521, target/123607, target/123742, testsuite/123353, tree-optimization/122793, tree-optimization/122868, tree-optimization/123040, tree-optimization/123300, tree-optimization/123351, tree-optimization/123372, tree-optimization/123431, tree-optimization/123513, tree-optimization/123602, tree-optimization/123736, tree-optimization/123741 - Fix glibc32 build dependency (RHEL-113182) - ship libstdc++.modules.json (RHEL-97095) - Add AS_NEEDED libstdc++.so.6 when only needed through libstdc++_nonshared (RHEL-94866) - configure with --enable-host-pie --enable-host-bind-now (RHEL-95564) - re-enable annobin-plugin and offload-nvptx - update from releases/gcc-15 branch - PRs ada/112958, ada/120104, c/120057, c++/119863, c++/119864, c++/119938, c++/119939, c++/119981, c++/119996, c++/120012, c++/120013, c++/120023, c++/120125, c++/120161, c++/120350, fortran/102891, fortran/102900, fortran/119928, fortran/119986, fortran/120049, fortran/120107, fortran/120139, fortran/120163, fortran/120179, fortran/120191, ipa/119852, ipa/119973, ipa/120006, ipa/120146, libfortran/120152, libfortran/120153, libfortran/120158, libfortran/120196, libstdc++/118260, libstdc++/119427, libstdc++/119714, libstdc++/120029, libstdc++/120114, libstdc++/120159, libstdc++/120187, libstdc++/120190, libstdc++/120198, libstdc++/120293, modula2/115276, modula2/119914, modula2/119915, modula2/120117, modula2/120188, preprocessor/116047, preprocessor/120061, target/119610, testsuite/119909, tree-optimization/111873, tree-optimization/119712, tree-optimization/120043, tree-optimization/120048, tree-optimization/120074, tree-optimization/120089, tree-optimization/120143, tree-optimization/120211 - update from releases/gcc-15 branch - GCC 15.1 release - PRs fortran/119836, target/119327, target/119873, tree-optimization/118407 - Fix GTS version in package name. - Resolves: #2054087 (Update to 3.0.14) - Resolves: #2041724 (Update to 3.0.13) - Resolves: #2031657 (Update to 3.0.12) - Resolves: #2014989 (Update to 3.0.11) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: #1953449 (Update to 3.0.10) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 3.0.9 - Use CMake macros for the build - Change how python tests are invoked (RH bug #1865924) - ICU-22973 Fix buffer overflow by using CharString Resolves: RHEL-96664 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Handle BTN_STYLUS3 (RHEL-147703) - Fix crash when the Wacom Intuos Pro 3rd gen sends absolute wheel events - Add support for the Wacom Intuos Pro (RHEL-105483) - Rename existing patches for better order clarity - Add quirks for four more dell touchpads (RHEL-69798) - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream release - Fall back to the AliasId for validation - Fix jcat_context_verify_blob() to use self verify for checksums - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release - Allow verifying expired certificates with an additional argument - New upstream release - Export the old JCatEngine property to preserve internal ABI - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release - Export the JcatBlobKind and JcatBlobMethod on the result - Fix for CVE-2020-10759 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Backport fixes for kcapi-hasher target option Related: RHEL-15298 - Fix kcapi tests in FIPS mode Resolves: RHEL-2405 - Update to new upstream release 1.4.0 Resolves: RHEL-5367 - Add a patch to fix auxiliary tests in FIPS mode Resolves: RHEL-2405 - Add a patch to zeroize kcapi-hasher for FIPS 140-3 Resolves: RHEL-15112 - Add a patch to allow overriding target file in kcapi-hasher Resolves: RHEL-15298 - Remove ansi_cprng test as new kernels don't support it Resolves: RHEL-242707 - Add tag processing in AEAD decryption without ciphertext Resolves: RHEL-242667 - CVE-2026-71226: Fix memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path Resolves: RHEL-224815 - CVE-2026-71227: Fix infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return Resolves: RHEL-224976 - CVE-2026-71225: Fix IV reuse in libkcapi one-shot symmetric cipher chunking Resolves: RHEL-224704 - Rebase to upstream v0.5.5 Resolves: RHEL-86262 - Rebase to upstream v0.5.4 Resolves: RHEL-67143 - Add tests/ directory - Add gating.yaml to RHEL9 libkdumpfile - Update to 0.5.2 - Use SPDX license identifiers - Fix documentation build to be properly be noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebase to upstream v0.5.5 Resolves: RHEL-86262 - Rebase to upstream v0.5.4 Resolves: RHEL-67143 - Add tests/ directory - Add gating.yaml to RHEL9 libkdumpfile - Update to 0.5.2 - Use SPDX license identifiers - Fix documentation build to be properly be noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951286 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951286 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix cmake out-of-source FTBFS for F33/rawhide - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove ant-contrib support dropped compile.res_copy target so .properties files didn't get included in the jar so libloader didn't use its built-in loaders so libreoffice's database report generator didn't work - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951284 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Related: rhbz#1858035 build in side-tag - Resolves: rhbz#1858035 disable failing javadoc parts - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove ant-contrib support dropped compile.res_copy target so .properties files didn't get included in the jar so libloader didn't use its built-in loaders so libreoffice's database report generator didn't work - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951284 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Related: rhbz#1858035 build in side-tag - Resolves: rhbz#1858035 disable failing javadoc parts - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuild resolves: rhbz#2227729 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add skipempty to liblognorm json type resolves: rhbz#1990737 - Fix CVE-2023-26767 (#2181147) - Fix CVE-2023-26768 (#2181151) - Fix CVE-2023-26769 (#2181149) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix CVE-2023-26767 (#2181147) - Fix CVE-2023-26768 (#2181151) - Fix CVE-2023-26769 (#2181149) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix CVE-2023-26767 (#2181147) - Fix CVE-2023-26768 (#2181151) - Fix CVE-2023-26769 (#2181149) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.32 (RHEL-101709) - Update to 1.30.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + libmediaart-1.9.5-1 - Update to 1.9.5 from Fedora 34 - Resolves: rhbz#1965886 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + libmediaart-1.9.5-1 - Update to 1.9.5 from Fedora 34 - Resolves: rhbz#1965886 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - libmnl: zero attribute padding - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Upgrade to libmpc version 1.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Drop the libmpc-mpfr3 and libmpc-mpfr3-devel subpackages - Build the main package against mpfr4 - Make mpfr3 and mpfr3-devel subpackages - Drop the compat-libmpc package; nothing in Fedora needs it - Update project URL - Add a -doc subpackage to hold the GFDL-licensed content - Drop unnecessary texinfo BR - Drop ldconfig_scriptlets; this version cannot appear in distros that need it - Make sure there are no rpaths and that -Wl,--as-needed takes effect - Add gating and fix gating errors. rhbz#2047292 - Fix FTBFS. rhbz#2046759 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix FTBFS. rhbz#1987721 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix FTBFS. rhbz#1943037 - Fix enablement of wxi tests - Use perl-base and gettext for more minimal dep chain - new version v0.101 - Fix FTBFS. rhbz#1923683 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix FTBFS. rhbz#1864178 - Drop mingw-gstreamer* checks, it's outdated. - Add gating and fix gating errors. rhbz#2047292 - Fix FTBFS. rhbz#2046759 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix FTBFS. rhbz#1987721 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix FTBFS. rhbz#1943037 - Fix enablement of wxi tests - Use perl-base and gettext for more minimal dep chain - new version v0.101 - Fix FTBFS. rhbz#1923683 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix FTBFS. rhbz#1864178 - Drop mingw-gstreamer* checks, it's outdated. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix missing #include for gcc-10 - Rebuild for ICU 65 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix missing #include for gcc-10 - Rebuild for ICU 65 - Disable player match that breaks Bluetooth on Mediatek MT7925 adapters (RHEL-140110) - rhbz#2031658 merge in fedora 34 changes - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - new upstream release - new upstream release - new upstream release - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - rhbz#2031658 merge in fedora 34 changes - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - new upstream release - new upstream release - new upstream release - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - rhbz#2031658 merge in fedora 34 changes - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - new upstream release - new upstream release - new upstream release - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - add provides for rng-double library #2064301 - add provides for fastapprox library #2064301 - add gating.yaml file - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuild for versioned symbols in json-c - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to libndp 1.9 - Convert the license tag to SPDX format Related: RHELMISC-1363 - Apply upstream patch to fix 3 findings from static application security testing Resolves: RHEL-27656 - src: fix incorrect building and parsing of the NFCTH_POLICY_SETX attribute - examples: kill the "invalid argument" error in nftc-helper-add - examples: fix double free in nftc-helper-add - include: Sync with kernel headers - src: fix use after free - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 3.11.0 release (RHEL-67129) - Update to 3.9.0 release (RHEL-17843) - Update to 3.8.0 release (RHEL-17843) Rebase to 1.28 for startup and performance fixes threads: add config check to match min value with pong timeouts rx: allow links to be active faster links: fix ping interval and pong timeout value checking crypto: Try crypt and decrypt on crypto_init tx: Remove expensive memsets log: Add a TRACE log level Resolves: #RHEL-11787 Rebase to 1.25 for PMTUd fixes Resolves: rhbz#2161168 - Fix libnozzle tests failing & covscan warning on api_knet_handle_new test Resolves: rhbz#2024090 - Rebase to 1.24 Resolves: rhbz#2024090 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - latest version - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix linked list corruption RHEL-146273 - Respin for RHEL-114102 - Rebase to version 1.16.1 (RHEL-114102) - Update to version 1.13 (RHEL-88847) - TLS Fixes (RHEL-53980) - Update libnvme to version 1.11 (RHEL-67145) - Update to latest upstream version RHEL-61573 - Backport fix for RHEL-49544 - Backport URI parser API - Rebase to version 1.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - fix build without libixion under rhel - build without libixion under rhel - Fix missing headers for gcc-11 - latest release - reenable make check - replace -DSIZEOF_VOID_P=4 with upstream solution - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - fix build without libixion under rhel - build without libixion under rhel - Fix missing headers for gcc-11 - latest release - reenable make check - replace -DSIZEOF_VOID_P=4 with upstream solution - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - fix build without libixion under rhel - build without libixion under rhel - Fix missing headers for gcc-11 - latest release - reenable make check - replace -DSIZEOF_VOID_P=4 with upstream solution - Update to 1.10.0 release - Warn on EACCES error when skipMissing is set Resolves: rhbz#2051559 - Improve error message on failure to access database due permission Related: rhbz#1942431 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.9.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - related: rhbz#2048653 - Add package to CRB - related: rhbz#2028819 - Update to version 1.1.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build using new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - related: rhbz#2048653 - Add package to CRB - related: rhbz#2028819 - Update to version 1.1.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build using new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - related: rhbz#2048653 - Add package to CRB - related: rhbz#2028819 - Update to version 1.1.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build using new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1100-1196) - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto authencesn/algif) - Keep the smb cifs.spnego ahead-fix (retained as 1197) - RHEL changelog for 687.6.1..687.10.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable backports (SOURCES/1198-1252) - RHEL changelog for 687.11.1..687.12.1 follows: - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) - RHEL changelog for 687.13.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.19.1..687.20.1 follows: - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) - RHEL changelog for 687.18.1..687.19.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] - net: Fix typos (Kamal Heib) [RHEL-169057] - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) - RHEL changelog for 687.16.1..687.17.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] - dpll: add pin operational state (Ivan Vecera) [RHEL-175820] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) - RHEL changelog for 687.14.1..687.15.1 follows: - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll ep_remove use-after-free CVE-2026-46242 (1712) - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux ahead-patch (1312) is retained and RHEL's duplicate copy omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 687.21.1..687.22.1 follows: - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - RHEL changelog for 687.23.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) - RHEL changelog for 687.26.1 follows: - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1756, 1757) are superseded by RHEL's copies and dropped - RHEL changelog for 687.25.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are superseded by RHEL's copies and dropped - RHEL changelog for 687.24.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180773] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150} - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886] - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113} - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943] - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110} - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121] - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121] - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121] - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121] - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121] - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121] - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121] - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121] - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121] - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121] - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121] - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121] - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121] - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121] - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121] - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121] - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121] - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121] - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121] - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121] - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121] - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071} - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980] - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973} - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729] - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729] - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729] - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729] - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729] - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729] - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342] - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002} - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257] - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575] - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058] - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058] - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058] - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415} - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331] - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578] - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036] - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999] - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - x86/mm: Add missing saved dirty bit to page protection change mask (Luiz Capitulino) [RHEL-220787] - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218181] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214434] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214434] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-192081] {CVE-2026-53202} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811] - drm/amdgpu: fix amdgpu_hmm_range_get_pages (José Expósito) [RHEL-222614] {CVE-2026-63879} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065] - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549] - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370} - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386} - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382} - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333] - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276} - netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211} - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118] - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398] - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398] - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489] - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508] - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508] - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548] - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129] - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619] - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619] - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762] - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762] - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762] - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762] - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762] - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762] - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762] - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762] - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762] - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762] - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762] - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762] - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762] - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762] - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762] - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762] - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243} - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109} - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144} - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611] - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611] - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611] - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611] - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611] - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210} - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040} - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818} - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340] - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340] - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340] - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193} - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552] - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231} - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180} - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209} - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111} - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938] - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126] - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126] - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126] - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126] - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126] - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126] - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126] - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126] - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126] - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126] - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126] - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126] - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693] - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765] - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765] - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100} - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765] - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883} - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765] - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765] - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845} - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765] - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844} - redhat: update self-test data (Patrick Talbert) - redhat: set defaults for 9.8 (Patrick Talbert) - gitlab-ci: disttag override for 9.8 (Patrick Talbert) - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213202] {CVE-2026-63887} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244913] {CVE-2026-72130} - sched/rt: Skip currently executing CPU in rto_next_cpu() (CKI Backport Bot) [RHEL-240634] - smc: Fix use-after-free in __pnet_find_base_ndev(). (Ramesh Chhetri) [RHEL-152651] {CVE-2025-40064} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-240761] {CVE-2026-68166} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234043] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227785] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229407] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228038] {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226457] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225521] {CVE-2026-53397} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234488] {CVE-2026-64438} - KEYS: fix overflow in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - KEYS: fix length validation in keyctl_pkey_params_get_2() (Bruno Meneguele) [RHEL-229627] {CVE-2026-63824} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230496] {CVE-2026-68480} - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230496] - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234535] {CVE-2026-64304} - tpm: tpm_tis: stop transmit if retries are exhausted (Štěpán Horáček) [RHEL-213940] - tpm: tpm_tis: add error logging for data transfer (Štěpán Horáček) [RHEL-213940] - tpm, tpm_tis: Workaround failed command reception on Infineon devices (Štěpán Horáček) [RHEL-213940] - tpm_tis: Resend command to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - tpm_tis: Use responseRetry to recover from data transfer errors (Štěpán Horáček) [RHEL-213940] - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231664] {CVE-2026-63886} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230139] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229228] {CVE-2026-64018} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229064] {CVE-2026-46185} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225285] {CVE-2026-45970} - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219525] {CVE-2026-64268} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219152] {CVE-2026-64387} - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (Štěpán Horáček) [RHEL-189953] {CVE-2025-71147} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (Waiman Long) [RHEL-242684] {CVE-2026-72069} - locking/rt: Add sparse annotation for RCU. (Waiman Long) [RHEL-242684] - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - iomap: hold state_lock over call to ifs_set_range_uptodate() (CKI Backport Bot) [RHEL-240191] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231461] {CVE-2026-63808} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227266] {CVE-2026-64002} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223126] {CVE-2026-53073} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320} - can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004} - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226071] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225592] {CVE-2026-43339} - ipv6: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] - ipv4: account for fraggap on the paged allocation path (Felix Maurer) [RHEL-212891] {CVE-2026-53366} - inet: ping: fix recent breakage (Felix Maurer) [RHEL-212891] - net: unify alloclen calculation for paged requests (Felix Maurer) [RHEL-212891] - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225858] {CVE-2026-53223} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248451] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246930] {CVE-2026-74480} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244971] {CVE-2026-72129} - Revert "net/smc: Introduce TCP ULP support" (Jan Polensky) [RHEL-227559] {CVE-2026-46330} - smb: client: fix double-free in SMB2_close() replay (CKI Backport Bot) [RHEL-240049] {CVE-2026-64597} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226689] {CVE-2026-43493} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230988] {CVE-2026-64034} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225785] {CVE-2026-46149} - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224454] {CVE-2026-53002} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189457] {CVE-2026-43133} - mm/ksm: add option to deduplicate only zero pages (Andrea Arcangeli) [RHEL-249161] - mm/ksm: don't waste time searching stable tree for fast changing page (Andrea Arcangeli) [RHEL-249161] - mm/hugetlb.c: undo errant change (Andrea Arcangeli) [RHEL-249161] - mm/ksm: refactor out try_to_merge_with_zero_page() (Andrea Arcangeli) [RHEL-249161] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254594] {CVE-2026-74556} - gfs2: bufdata allocation race (Andreas Gruenbacher) [RHEL-178223] - gfs2: Remove trans_drain code duplication (Andreas Gruenbacher) [RHEL-178223] - gfs2: Move gfs2_remove_from_journal to log.c (Andreas Gruenbacher) [RHEL-178223] - gfs2: Get rid of gfs2_log_[un]lock helpers (Andreas Gruenbacher) [RHEL-178223] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-242822] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231042] {CVE-2026-63923} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240242] {CVE-2026-68294} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-237383] {CVE-2026-68143} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225660] {CVE-2026-64015} - vhost: move vdpa group bound check to vhost_vdpa (Jon Maloy) [RHEL-174277] {CVE-2026-43248} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (José Expósito) [RHEL-222458] - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (José Expósito) [RHEL-236583] {CVE-2026-68264} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489] - kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489] - selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489] - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745} - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246} - wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406} - wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945} - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025] - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050] - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692} - gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219] - gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219] - gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219] - gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219] - gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219] - gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219] - gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243} - gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986] - watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733] - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174} - wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003} - net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172} - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159} - gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540] - gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540] - gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540] - gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540] - gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix infinite loop when checking ail item count before go_inval" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Allow some glocks to be used during withdraw" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Check for log write errors before telling dlm to unlock" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: fix a deadlock on withdraw-during-mount" (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (6/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (5/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (4/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (3/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (2/6) (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: Force withdraw to replay journals and wait for it to finish" (1/6) (Andreas Gruenbacher) [RHEL-252540] - gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540] - Revert "gfs2: don't stop reads while withdraw in progress" (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540] - gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540] - gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540] - gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540] - gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540] - gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540] - gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540] - gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228016] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231753] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228936] {CVE-2026-63921} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244932] {CVE-2026-72102} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-243028] {CVE-2026-68200} - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-240325] {CVE-2026-68128} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap (Kamal Heib) [RHEL-233826] {CVE-2026-64582} - RDMA/rxe: Reject unknown opcodes before ICRC processing (Kamal Heib) [RHEL-226877] {CVE-2026-46133} - RDMA/rxe: Fix race condition in QP timer handlers (Kamal Heib) [RHEL-226914] {CVE-2026-45910} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Kamal Heib) [RHEL-228182] {CVE-2026-46043} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (Kamal Heib) [RHEL-226315] {CVE-2026-46114} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230627] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228693] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227713] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227087] {CVE-2026-53193} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-226406] {CVE-2026-63913} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191605] {CVE-2026-53176} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191035] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191035] {CVE-2026-53196} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108] - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072} - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155} - libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823} - ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003] - ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003] - ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003] - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003] - dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977} - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129} - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007} - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261} - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634] - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006} - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970} - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385} - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206} - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634] - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867} - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634] - netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060} - netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634] - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399} - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001} - netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634] - netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634] - netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251] - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121} - mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539} - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714} - drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416] - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964] - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964] - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299] - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323} - drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443] - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199} - netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875} - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556} - ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972} - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522} - RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325} - RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788] - RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788] - Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656] - RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563] - rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998} - net: skbuff: propagate shared-frag marker in skb_zerocopy() - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - lpfc: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280075] {CVE-2026-98320} - vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270901] {CVE-2026-89777} - md/raid5-ppl: fix use-after-free in ppl_do_flush() (CKI Backport Bot) [RHEL-278089] {CVE-2026-93262} - KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279504] {CVE-2026-98222} - KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277620] {CVE-2026-74515} - smb: client: guard against tailsz underflow in wdata_send_pages() (Paulo Alcantara) [RHEL-257205] - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-257205] - smb: client: fix rlist race and missing initialization (Paulo Alcantara) [RHEL-257205] {CVE-2026-98174} - smb: client: cancel reconnect work in clean_demultiplex_info() (Paulo Alcantara) [RHEL-257205] {CVE-2026-98175} - smb/client: send lease break ACKs thru correct session for multiuser mounts (Paulo Alcantara) [RHEL-257205] - smb: client: fix cifsFileInfo reference leak in deferred close (Paulo Alcantara) [RHEL-257205] {CVE-2026-97558} - smb: client: avoid leaking refcount when cifs_sb_tlink() fails (Paulo Alcantara) [RHEL-257205] {CVE-2026-97556} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() (Paulo Alcantara) [RHEL-257205] {CVE-2026-97557} - smb: client: fix data corruption with concurrent writes and O_TRUNC (Paulo Alcantara) [RHEL-257205] - cifs: don't update i_size in cifs_do_truncate without a cached handle (Paulo Alcantara) [RHEL-257205] - smb: client: invalidate fscache for fallocate range operations (Paulo Alcantara) [RHEL-257205] {CVE-2026-98124} - smb: client: fix stale page cache in insert/collapse range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98125} - smb: client: fix integer truncation in collapse range (Paulo Alcantara) [RHEL-257205] - smb: client: fix data corruption in emulated insert range (Paulo Alcantara) [RHEL-257205] - smb/client: mark file sparse before emulating insert range (Paulo Alcantara) [RHEL-257205] - smb/client: validate new EOF for zero range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98126} - smb/client: validate new EOF for insert range (Paulo Alcantara) [RHEL-257205] {CVE-2026-98127} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() (Paulo Alcantara) [RHEL-257205] - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (Paulo Alcantara) [RHEL-257205] {CVE-2026-89640} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending (Paulo Alcantara) [RHEL-257205] {CVE-2026-89642} - cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (Paulo Alcantara) [RHEL-257205] {CVE-2026-89641} - smb/client: decode reparse metadata using its payload type (Paulo Alcantara) [RHEL-257205] - smb/client: preserve open info type across compound queries (Paulo Alcantara) [RHEL-257205] - smb/client: mark missing nlink values as unknown (Paulo Alcantara) [RHEL-257205] - smb/client: fix nlink of an overwritten open file (Paulo Alcantara) [RHEL-257205] - cifs: remove dead size-update blocks in cifs_setattr_unix/nounix (Paulo Alcantara) [RHEL-257205] - cifs: remove redundant size-update block in cifs_remap_file_range() (Paulo Alcantara) [RHEL-257205] - cifs: add cifs_resize_file_locked() to guard fscache_resize_cookie() under i_rwsem (Paulo Alcantara) [RHEL-257205] - cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (Paulo Alcantara) [RHEL-257205] {CVE-2026-89639} - cifs: add fscache_resize_cookie() to cifs_setsize() (Paulo Alcantara) [RHEL-257205] - smb: client: simplify cifs_fscache_get_super_cookie() (Paulo Alcantara) [RHEL-257205] - smb/client: flush dirty data before punching a hole (Paulo Alcantara) [RHEL-257205] {CVE-2026-93794} - smb/client: refresh allocation after EOF-extending fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: emulate small EOF-extending mode 0 fallocate ranges (Paulo Alcantara) [RHEL-257205] - smb/client: reduce fallocate zero buffer allocation (Paulo Alcantara) [RHEL-257205] - smb/client: refresh allocation size after duplicate extents (Paulo Alcantara) [RHEL-257205] - smb: client: use kvzalloc() for megabyte buffer in simple fallocate (Paulo Alcantara) [RHEL-257205] - smb/client: fix incorrect nlink returned by fstat() (Paulo Alcantara) [RHEL-257205] - smb/client: zero-initialize stack-allocated cifs_open_info_data (Paulo Alcantara) [RHEL-257205] {CVE-2026-93801} - smb/client: pass cifs_open_info_data to SMB2_open() (Paulo Alcantara) [RHEL-257205] - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() (Paulo Alcantara) [RHEL-257205] - smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit() (Paulo Alcantara) [RHEL-257205] - smb/client: do not account EOF extension as allocation (Paulo Alcantara) [RHEL-257205] - smb/client: preserve errors from smb2_set_sparse() (Paulo Alcantara) [RHEL-257205] - smb/client: name the default fallocate mode (Paulo Alcantara) [RHEL-257205] - smb/client: update i_blocks after contiguous writes (Paulo Alcantara) [RHEL-257205] - smb: client: fix races in cifsd thread creation (Paulo Alcantara) [RHEL-257205] {CVE-2026-93829} - cifs: invalidate cfid on unlink/rename/rmdir (Paulo Alcantara) [RHEL-257205] - cifs: abort open_cached_dir if we don't request leases (Paulo Alcantara) [RHEL-257205] - cifs: change_conf needs to be called for session setup (Paulo Alcantara) [RHEL-257205] - smb: client: fix generic/694 due to wrong ->i_blocks (Paulo Alcantara) [RHEL-257205] - smb: client: fix open handle lookup in cifs_open() (Paulo Alcantara) [RHEL-257205] - smb: client: fix in-place encryption corruption in SMB2_write() (Paulo Alcantara) [RHEL-257205] {CVE-2026-43362} - smb: client: fix atomic open with O_DIRECT & O_SYNC (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsglob.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/fscache.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsfs.h (Paulo Alcantara) [RHEL-257205] - cifs: Scripted clean up fs/smb/client/cifsproto.h (Paulo Alcantara) [RHEL-257205] - udp: Deal with race between UDP socket address change and rehash (Jamie Bainbridge) [RHEL-257635] {CVE-2024-57974} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CKI Backport Bot) [RHEL-271257] {CVE-2026-89638} - net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232134] {CVE-2026-63978} - net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232134] - net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230363] {CVE-2026-63979} - net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234159] {CVE-2026-64523} - fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - fuse: fix page stealing (Miklos Szeredi) [RHEL-226093] {CVE-2026-53388} - ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263800] {CVE-2026-68476} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (CKI Backport Bot) [RHEL-243225] {CVE-2026-72242} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258557] {CVE-2026-80824} - fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234250] {CVE-2026-64266} - xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536} - ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448} - ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202} - calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063} - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299} - ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481} - rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029] - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999} - smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631} - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260} - perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633} - strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747] - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697] - bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032} - net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528] - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572} - inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899} - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974} - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985} - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526} - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003} - wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404} - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011} - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970} - drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811} - drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309} - drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806] - drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236} - drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245} - drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123} - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201] - redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014] - rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014] - rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014] - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103} - sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279] - sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279] - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360} - x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577] - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115} - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035} - iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480] - dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410] - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275} - io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192] - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480} - ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829} - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029] - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099} - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516} - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777] - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289} - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746} - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942} - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986} - gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049} - gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149} - Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481] - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936] - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936] - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936] - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794} - Add libpfm-ibm-counters.patch - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.6.0 - bug fixes - Update to 2.4.92 - update pinyin data - bug fixes - Update to 2.4.91 - improve full pinyin auto correction - bug fixes - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - update to 1.5.3 resolves: #1868648 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - update to 1.5.2 resolves #1787794 - Don't prepend sysroot_dir if pkg-config file lies outside of sysroot_dir resolves: rhbz#1975416 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize the unit tests, disable them on RHEL 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use internal target platform definition for pkg-config wrapper - Fix pkg-config wrapper for armv7hl - Make /usr/bin/pkg-config multilib safe - Add /usr/local paths to pkg-config(1) search path for non RPM builds - Update to 1.7.3 - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161448) - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161299) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148411) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000) - CVE-2025-64720: buffer overflow (RHEL-131594) - CVE-2025-65018: heap buffer overflow (RHEL-131603) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148411) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000) - CVE-2025-64720: buffer overflow (RHEL-131594) - CVE-2025-65018: heap buffer overflow (RHEL-131603) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294) - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161448) - fix CVE-2026-33636: out-of-bounds R/W in the palette expansion on ARM Neon (RHEL-161299) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148411) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000) - CVE-2025-64720: buffer overflow (RHEL-131594) - CVE-2025-65018: heap buffer overflow (RHEL-131603) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294) - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148411) - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356) - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000) - CVE-2025-64720: buffer overflow (RHEL-131594) - CVE-2025-65018: heap buffer overflow (RHEL-131603) - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add patch to correct 'extern "C"' usage - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: #1913613 (Disable DII (and ImageMagic dependency) for RHEL 9) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - FTBFS fix: %{__python} must now be explicitly defined - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Cleanup conditionals for using python3 - Rebuilt for Boost 1.73 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add patch to correct 'extern "C"' usage - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: #1913613 (Disable DII (and ImageMagic dependency) for RHEL 9) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - FTBFS fix: %{__python} must now be explicitly defined - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Cleanup conditionals for using python3 - Rebuilt for Boost 1.73 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add patch to correct 'extern "C"' usage - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: #1913613 (Disable DII (and ImageMagic dependency) for RHEL 9) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - FTBFS fix: %{__python} must now be explicitly defined - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Cleanup conditionals for using python3 - Rebuilt for Boost 1.73 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add patch to correct 'extern "C"' usage - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: #1913613 (Disable DII (and ImageMagic dependency) for RHEL 9) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - FTBFS fix: %{__python} must now be explicitly defined - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Cleanup conditionals for using python3 - Rebuilt for Boost 1.73 - Rebase to 2.0.8 Resolves: rhbz#2223950 - bump rpm version for rhel-exception build Resolves: rhbz#2230712 - blackbox: fix buffer overflow with long log lines Resolves: rhbz#2236171 - ipc: Retry receiving credentials if the the message is short Resolves: rhbz2149647 - Rebase to 2.0.6 Resolves: rhbz#2072903 - Fix negative errno in qb_ipcc_connect (introduced in 2.0.3-4) Resolves: rhbz#2057527 - Bump soname for async-connect API addition Resolves: rhbz#bz2031865 - Fix gating.yaml for RHEL-9 Resolves: rhbz#bz2031865 - Add gating.yaml from RHEL Resolves: rhbz#bz2031865 - Add async connect call for Pacemaker Resolves: rhbz#bz2031865 - Update to 1.32.2 - Include libqrtr build dependency (rh #2032807) - Update to 1.30.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.26.8 - Update to 1.2.2 - Rebuild with CI gating enabled - Import the fedora 35 srpm to CentOS 9 stream. - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Initial package - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Debrand for AlmaLinux - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Fix CVE-2024-3044 add notify for script use - Fix CVE-2023-6185 escape url passed to gstreamer - Fix CVE-2023-6186 check link target protocols - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded without prompt via IFrame - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write - Fix erroneous libreoffice-ure dependencies - Resolves: rhbz#2182392 CVE-2022-38745 - Debrand for AlmaLinux - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Fix CVE-2024-6472 remove ability to trust not validated macro signatures in high security - Debrand for AlmaLinux - Resolves: RHEL-269334 CVE-2026-63274 heap buffer overflow in PDF import stream handling - Resolves: RHEL-269195 CVE-2026-63275 stack buffer overflow in CFF font hint handling - Resolves: RHEL-269182 CVE-2026-63276 stack buffer overflow in CFF to Type 1 font conversion - Resolves: RHEL-276436 CVE-2026-63277 Arbitrary code execution via remote Java database driver - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in formula compilation - Resolves: RHEL-186062 - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of the spec has - Resolves: RHEL-176576 - Fix CVE-2025-1080 Filter out more unwanted command URIs - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Add support for AlmaLinux Bug Tracker - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla - [reporter-bugzilla] Retry XML-RPC calls - Resolves: rhbz#2037399 - [reporter-bugzilla] Fix subcomponent handling - Resolves: rhbz#2037399 - Change the default Bugzilla group - Resolves: rhbz#2037399 - Rebuild against json-c-0.14-11 Related: rhbz#2023322 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version 2.15.2 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop AnacondaRHEL workflow reference - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951282 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Resolves: rhbz#1858037 disable failing javadoc parts - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951282 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Resolves: rhbz#1858037 disable failing javadoc parts - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Resolves: rhbz#1786466 Do not use %{?_isa} for GDB dependency. - fix devel-usability test - rebase to 2.5.2 resolves: rhbz#2019887 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Apply fixes to change internal handling of the notification fd (#1865802) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream version (#1858965) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Modernize spec - Backport fix for missing __SNR_ppoll symbol (#1777889) - Refresh patch to build on aarch64 with upstream version - New upstream version (#1765314) - improve performance of semanage store rebuild (RHEL-79100) - Set new restorecon handle before doing restorecon (RHEL-76472) - open lock_file with O_RDWR (RHEL-60503) - Preserve file context and ownership in policy store (RHEL-31216, RHEL-54389) - SELinux userspace 3.6 release - SELinux userspace 3.6-rc1 release - Include more parameters in the module checksum (#2173959) - Fix linking of gssapi to support kerberos - Resolves: RHEL-6802 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951281 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951281 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Remove ant-contrib support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.13 - spec file cleanup - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix configure tests compromised by LTO - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Some static analysis fixes for unitialized structs Resolves: RHEL-25498 - Fix a memory leak in parse_package() of repo conda (RHEL-25496) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178982) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Backport patch for CVE-2026-5119 - Backport patch for CVE-2026-1761 - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode - Backport patch for CVE-2025-14523 - Backport patch for CVE-2025-4945 and CVE-2025-11021 - Backport patches for various CVEs Resolves: RHEL-84797 Resolves: RHEL-85888 Resolves: RHEL-87080 Resolves: RHEL-92284 - Backport patches for various CVEs, plus test improvements Resolves: RHEL-85909 Resolves: RHEL-85915 Resolves: RHEL-85920 Resolves: RHEL-87058 Resolves: RHEL-87068 Resolves: RHEL-87101 Resolves: RHEL-87119 Resolves: RHEL-88360 Resolves: RHEL-88363 - Enable tests in check, and add patches to fix tests Resolves: RHEL-76426 - Add patches for CVE-2024-52530, CVE-2024-52531, and CVE-2024-52532 Resolves: RHEL-67069 Resolves: RHEL-67081 - Fix CVE-2026-15711: Reject oversized WebSocket control frames - Backport patch for CVE-2026-15709 - Backport patch for CVE-2026-5119 - Backport patch for CVE-2026-1761 - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode - Backport patch for CVE-2025-14523 - Backport patch for CVE-2025-4945 and CVE-2025-11021 - Backport patches for various CVEs Resolves: RHEL-84797 Resolves: RHEL-85888 Resolves: RHEL-87080 Resolves: RHEL-92284 - Backport patches for various CVEs, plus test improvements Resolves: RHEL-85909 Resolves: RHEL-85915 Resolves: RHEL-85920 Resolves: RHEL-87058 Resolves: RHEL-87068 Resolves: RHEL-87101 Resolves: RHEL-87119 Resolves: RHEL-88360 Resolves: RHEL-88363 - Enable tests in check, and add patches to fix tests Resolves: RHEL-76426 - CVE-2026-102556 libsoup: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth - CVE-2026-102559 libsoup: libsoup: Heap buffer overflow during WebSocket client-frame masking - CVE-2026-102560 libsoup: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth - CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly message reassembly - Fix CVE-2026-15711: Reject oversized WebSocket control frames - Backport patch for CVE-2026-15709 - Backport patch for CVE-2026-5119 - Backport patch for CVE-2026-1761 - Backport patch for CVE-2026-0719 - Fix NTLM authentication test failures in FIPS mode - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 20200505 version (#1831576) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 20190731. Fixes bug #1742423 - fix NSS incompatibility, thanks to George Joseph Resolves: rhbz#2211526 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-154804 Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-167758 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-150277 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8 - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache - Related: RHEL-114548 - Rebase Samba to the latest 4.23.x release - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9] - Resolves: RHEL-103434 - cache_credentials = true not working - Related: RHEL-89873 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7 - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9] - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9] - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649 - Resolves: RHEL-82419 - Disk cache failure with large db sizes [rhel-9] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Add explicit conflicts to help with upgrades - Update to 3.39.94 - Split sysprof-capture library and header files out to sysprof-capture-devel - Update minimum required glib2 version - Update to 3.39.92 - Specify pic for static libsysprof-capture - Update to 3.39.90 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Add explicit conflicts to help with upgrades - Update to 3.39.94 - Split sysprof-capture library and header files out to sysprof-capture-devel - Update minimum required glib2 version - Update to 3.39.92 - Specify pic for static libsysprof-capture - Update to 3.39.90 - fix the Requires package name for teamd-devel - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852) - teamd: do no remove the ports on shutdown with -N (rhbz#2148854) - Rebuilt with a new version to pass the fixed gating test (rhbz#2060445) - utils/team2bond: do not add updelay/downdelay if already exist (rhbz#2060445) - utils/team2bond: do not add miimon if already exist (rhbz#2060445) - Revert "teamd: Disregard current state when considering port enablement" [1894546] - Remove an extra line in spec file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build util team2bond in teamd rpm [1986788] - Add some cautions to util team2bond [1986788] - Add team2bond man doc [1986788] - gating: fix the wrong link of openvswitch for RHEL-9 [1970175] - fix the Requires package name for teamd-devel - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852) - teamd: do no remove the ports on shutdown with -N (rhbz#2148854) - Rebuilt with a new version to pass the fixed gating test (rhbz#2060445) - utils/team2bond: do not add updelay/downdelay if already exist (rhbz#2060445) - utils/team2bond: do not add miimon if already exist (rhbz#2060445) - Revert "teamd: Disregard current state when considering port enablement" [1894546] - Remove an extra line in spec file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build util team2bond in teamd rpm [1986788] - Add some cautions to util team2bond [1986788] - Add team2bond man doc [1986788] - gating: fix the wrong link of openvswitch for RHEL-9 [1970175] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use new macros, update config.\* locations - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189387) - rebuild - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159331) - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543) - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238) - backport documentation change for CVE-2023-52355 (RHEL-17328) - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-17337) - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52931) - rebuild - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159331) - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543) - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238) - backport documentation change for CVE-2023-52355 (RHEL-17328) - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-17337) - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52931) - Fix CVE-2025-49133 (build for 9.7) Resolves: RHEL-96254 - Fix CVE-2025-49133 Resolves: RHEL-96258 - Backport "tpm2: Return TPM_RC_VALUE upon decryption failure" Resolves: RHEL-58056 - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Debrand for AlmaLinux - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding branches and calls to gcov output, but not conditions (RHEL-105416). - Fix testsuite failures when run with -fstack-protector* (PR testsuite/70230, RHEL-116477) - Add cross compilers for ppc64le and s390x for non-production uses (RHEL-94764) - Adjust glibc32 build dependency (RHEL-105072) - Exception handling performance improvements (RHEL-105072) - libgcc: Use _dl_find_object to find DWARF data in unwinder - libgcc: Use lock-free data structures for run-time unwinder registration - Pin modification time for python files to SOURCE_DATE_EPOCH (RHEL-100148). - Sync libstdc++ pretty printers to latest GTS (RHEL-81975) - Fix folding of BIT_NOT_EXPR for POLY_INT_CST (PR 118976, RHEL-90239) - rs6000: Rework ELFv2 support for -fpatchable-function-entry (PR target/99888, RHEL-75806) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 20200413 version (#1823434) - Update to 20200313 version (#1813493) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - New upstream release 0.1.7 (rhbz#1805154) - Add tests-examples sub-package and %check - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Pull in new upstream libusb containing important regression fixes Resolves: #2058730 Resolves: #1938801 - Updated and new regression fixes Resolves: #2058730 Related: #1938801 - Fix a crash if a transfer outlives closing the device Related: #1938801 - Update to 1.0.25 - Fix a crash after libusb_exit API has been misused - Add patchset to fix covscan reports Resolves: #1938801 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Pull in upstream bugfixes Resolves: #1929148 - Update to 1.0.24 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 1.0.30 to include the major bug fixes - Include the necessary API for fwupd backporting to RHEL9. Resolves: RHEL-183213 - Pull in new upstream libusb containing important regression fixes Resolves: #2058730 Resolves: #1938801 - Updated and new regression fixes Resolves: #2058730 Related: #1938801 - Fix a crash if a transfer outlives closing the device Related: #1938801 - Update to 1.0.25 - Fix a crash after libusb_exit API has been misused - Add patchset to fix covscan reports Resolves: #1938801 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Pull in upstream bugfixes Resolves: #1929148 - Update to 1.0.24 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 1.0.30 to include the major bug fixes - Include the necessary API for fwupd backporting to RHEL9. Resolves: RHEL-183213 - Backport fix for CVE-2024-24806 Resolves: RHEL-24791 - Update to 1.5 - rhbz#2075057 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New upstream version (0.3.2) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version (0.3.1) - Drop tevent goo and RHEL conditionals - Rebuild for libevent soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebased to 4.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebased to 4.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebased to 4.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebased to 4.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebased to 4.0.0 release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Enable building for ppc64le - conf: Parse hyperv features even for host-model (RHEL-151684) - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151953) - domain_conf: initialize network hostdev private data (RHEL-151953) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353) - util: Move openning IOMMU device to viriommufd (RHEL-150353) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353) - util: Move openning VFIO device to virpci (RHEL-150353) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353) - qemuxmlconftest: Refactor host device preparation (RHEL-150353) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353) - qemu: Save IOMMUFD state into status XML (RHEL-150353) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353) - qemu_command: Extract building IOMMUFD props to function (RHEL-150353) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353) - conf: Introduce iommufd enum for domaincaps (RHEL-138544) - qemu: Fill iommufd domain capability (RHEL-138544) - tests: properly mock VFIO and IOMMU checks (RHEL-138544) - iommufd: fix FD leak in case of error (RHEL-150353) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614) - qemu: Implement support for persistent reservation migration control (RHEL-140614) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866) - Introduce support for disk operation latency histogram collection (RHEL-147866) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866) - qemu: Ignore cmp_legacy CPU flag (RHEL-146629) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-141496) - qemu: Implement support for associating iommufd to hostdev (RHEL-126345) - qemu: Introduce privateData for hostdevs (RHEL-126345) - qemu: Support per-process memory accounting for iommufd (RHEL-126345) - qemu: open VFIO FDs from libvirt backend (RHEL-126345) - qemu: open iommufd FD from libvirt backend (RHEL-126345) - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345) - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345) - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770) - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770) - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770) - Enable building for ppc64le - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-178822) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-178822) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-178822) - qemu_capabilities: Always sort features in host-model CPU (RHEL-178822) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-178822) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-178822) - qemu_capabilities: Cache expanded CPU (RHEL-178822) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-178822) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-178822) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-178822) - cpu: Introduce virCPUUpdateFeatures (RHEL-178822) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-178822) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-178822) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-178822) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-178822) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-178822) - distro: Replace old gating with tmt - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154552) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154552) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154552) - docs: Clarify host-model description in domain capabilities (RHEL-154552) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159913) - security: Cleanup hostdev label error logic (RHEL-159913) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159913) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159174) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159174) - conf: Refactor virHostdevIsPCIDevice (RHEL-159174) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159174) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159174) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159174) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159174) - conf: Introduce domain iommufd element (RHEL-159174) - qemu: Implement iommufd (RHEL-159174) - conf: Add iommufd fdgroup support (RHEL-159174) - qemu: Implement iommufd fdgroup (RHEL-159174) - tests: Add iommufd fdgroup test (RHEL-159174) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159174) - conf: Parse hyperv features even for host-model (RHEL-151684) - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151953) - domain_conf: initialize network hostdev private data (RHEL-151953) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353) - util: Move openning IOMMU device to viriommufd (RHEL-150353) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353) - util: Move openning VFIO device to virpci (RHEL-150353) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353) - qemuxmlconftest: Refactor host device preparation (RHEL-150353) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353) - qemu: Save IOMMUFD state into status XML (RHEL-150353) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353) - qemu_command: Extract building IOMMUFD props to function (RHEL-150353) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353) - conf: Introduce iommufd enum for domaincaps (RHEL-138544) - qemu: Fill iommufd domain capability (RHEL-138544) - tests: properly mock VFIO and IOMMU checks (RHEL-138544) - iommufd: fix FD leak in case of error (RHEL-150353) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614) - qemu: Implement support for persistent reservation migration control (RHEL-140614) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866) - Introduce support for disk operation latency histogram collection (RHEL-147866) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866) - qemu: Ignore cmp_legacy CPU flag (RHEL-146629) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-141496) - Enable building for ppc64le - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245282, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242549) - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242549) - qemu: monitor: Remove support for 'watchdog-set-action' (RHEL-242549) - qemu: Remove 'allowReboot' field (RHEL-242549) - qemu: capabilities: Retire QEMU_CAPS_SET_ACTION (RHEL-242549) - qemuProcessSetupLifecycleActions: Prepare to handle other actions (RHEL-242549) - qemuDomainModifyLifecycleActionLive: Prepare to handle other actions (RHEL-242549) - processGuestPanicEvent: Don't pass panic action via parameter (RHEL-242549) - conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' (RHEL-242549) - qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message (RHEL-242549) - qemuProcessGuestPanicEventInfo: Fold into only caller (RHEL-242549) - qemu: processGuestPanicEvent: Split individual steps under separate conditions (RHEL-242549) - Add support for keeping VM running when panic notifier is used (RHEL-242549) - qemu: Fix proper ordering of 'virtlockd' shutdown (RHEL-224986) - Add guest device info to virDomainGetGuestInfo (RHEL-243306) - qemu_agent: Introduce guest-get-devices (RHEL-243306) - qemuagenttest: Introduce GetGuestDeviceInfo test case (RHEL-243306) - qemu: Implement device info for virDomainGetGuestInfo() API (RHEL-243306) - virsh: Add support for VIR_DOMAIN_GUEST_INFO_DEVICES (RHEL-243306) - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224986) - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622) - distro: Update URL in plans.fmf - qemu: capabilities: Apply 'capability_filters' configration option on all capabilities (RHEL-186018) - qemu: capabilities: Export 'virQEMUCapsNewCopy' outside of 'qemu_capspriv' (RHEL-186018) - qemu: Allow reuse of 'qemuProcessStartUpdateCustomCaps' (RHEL-186018) - qemu: validate: Validate VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186018) - qemu: postparse: Process VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186018) - virQEMUCapsCacheLookupDefault: Fix error message when no emulators are installed (RHEL-186018) - qemuxmlconfdata: un-symlink 'video-virtio-vga-gpu-gl' output (RHEL-186018) - qemuxmlconftest: Add 'video-virtio-vga' invocation with QEMU_CAPS_DEVICE_VIRTIO_VGA disabled (RHEL-186018) - qemuxmlconftest: Add test cases for configs asking for 'virtio-gpu-gl' or 'virtio-vga-gl' without the capability (RHEL-186018) - qemuxmlconftest: Add invocation of 'video-virtio-vga-gpu-gl' with missing caps and VIR_DOMAIN_DEF_PARSE_ABI_UPDATE (RHEL-186018) - qemustatusxml2xml: Add test case capturing virtio video device (RHEL-186018) - virDomainVideoDefFormat: Use 'virXMLFormatElement' instead of custom formatter (RHEL-186018) - conf: Add fields for recording actually-selected virtio video device (RHEL-186018) - qemuxmlconftest: Add test case for specifying 'virtio-gpu' where 'virtio-vga' would be picked (RHEL-186018) - qemuDeviceVideoGetModel: Directly return picked model (RHEL-186018) - qemu: postparse: Fill in selected virtio video frondend device in the XML (RHEL-186018) - qemuValidateDomainDeviceDefVideo: Fix checks of virtio video devices (RHEL-186018) - qemuDeviceVideoGetModel: Remove logic for selecting 'virtio' devices (RHEL-186018) - qemuDeviceVideoGetModel: Simplify by relying on checks from 'qemuValidateDomainDeviceDefVideo' (RHEL-186018) - qemu: Remove 'qemuDomainSupportsVideoVga' (RHEL-186018) - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-178822) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-178822) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-178822) - qemu_capabilities: Always sort features in host-model CPU (RHEL-178822) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-178822) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-178822) - qemu_capabilities: Cache expanded CPU (RHEL-178822) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-178822) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-178822) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-178822) - cpu: Introduce virCPUUpdateFeatures (RHEL-178822) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-178822) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-178822) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-178822) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-178822) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-178822) - distro: Replace old gating with tmt - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154552) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154552) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154552) - docs: Clarify host-model description in domain capabilities (RHEL-154552) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159913) - security: Cleanup hostdev label error logic (RHEL-159913) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159913) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159174) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159174) - conf: Refactor virHostdevIsPCIDevice (RHEL-159174) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159174) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159174) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159174) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159174) - conf: Introduce domain iommufd element (RHEL-159174) - qemu: Implement iommufd (RHEL-159174) - conf: Add iommufd fdgroup support (RHEL-159174) - qemu: Implement iommufd fdgroup (RHEL-159174) - tests: Add iommufd fdgroup test (RHEL-159174) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159174) - conf: Parse hyperv features even for host-model (RHEL-151684) - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151953) - domain_conf: initialize network hostdev private data (RHEL-151953) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953) - Enable building for ppc64le - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151953) - domain_conf: initialize network hostdev private data (RHEL-151953) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353) - util: Move openning IOMMU device to viriommufd (RHEL-150353) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353) - util: Move openning VFIO device to virpci (RHEL-150353) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353) - qemuxmlconftest: Refactor host device preparation (RHEL-150353) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353) - qemu: Save IOMMUFD state into status XML (RHEL-150353) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353) - qemu_command: Extract building IOMMUFD props to function (RHEL-150353) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353) - conf: Introduce iommufd enum for domaincaps (RHEL-138544) - qemu: Fill iommufd domain capability (RHEL-138544) - tests: properly mock VFIO and IOMMU checks (RHEL-138544) - iommufd: fix FD leak in case of error (RHEL-150353) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614) - qemu: Implement support for persistent reservation migration control (RHEL-140614) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866) - Introduce support for disk operation latency histogram collection (RHEL-147866) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866) - qemu: Ignore cmp_legacy CPU flag (RHEL-146629) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-141496) - qemu: Implement support for associating iommufd to hostdev (RHEL-126345) - qemu: Introduce privateData for hostdevs (RHEL-126345) - qemu: Support per-process memory accounting for iommufd (RHEL-126345) - qemu: open VFIO FDs from libvirt backend (RHEL-126345) - qemu: open iommufd FD from libvirt backend (RHEL-126345) - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345) - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345) - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770) - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770) - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770) - qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type (RHEL-140624) - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-144010) - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-144010) - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-144010) - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-144010) - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144090) - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144090) - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144090) - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144090) - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144090) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - new upstream release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - new upstream release - Rebuild for RHEL-9.8 - Resolves: RHEL-98267 - Rebuilt after updating rdma-core - Resolves: RHEL-98267 - bump release to rebuild in sidetag - Resolves: RHEL-98267 - Update to upstream release 9.8.80 - Resolves: RHEL-98267 - Update to upstream release 9.8.71. - Resolves: RHEL-94446 - Update to upstream release 9.8.60. - Resolves: RHEL-52882 - Update to upstream release 9.8.51. - Resolves: RHEL-24467 - Add patch for superindex full Resolves: RHEL-150344 - Add patch for double free Resolves: RHEL-93910 - Add patch to fix integer overflows. - Disable LTO to fix build - Resolves: RHEL-40655 - Added fix for CVE-2023-4863 - Bump the release to "7" to accommodate the 9.1.0.z release bumps as libwebp-1.2.0-6.el9 < libwebp-1.2.0-6.el9_1 - Add fix for mzbz#1819244 - Fix tools subpackage dependency - Bump the release to "6" to accommodate the 9.1.0.z release bumps - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix missing #includes for gcc-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add BuildRequires for make - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - libxkbcommon 1.0.3 - libxkbcommon 1.0.2 - libxkbcommon 1.0.1 - libxkbcommon 1.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - libxkbcommon 0.10.0 - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2024-25062 (RHEL-29196) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2024-56171 (RHEL-80127) - Fix CVE-2022-49043 (RHEL-76298) - Fix CVE-2026-11979 (RHEL-215568) - Fix CVE-2026-6653 (RHEL-215619) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Fix CVE-2025-24928 (RHEL-80142) - Fix CVE-2026-86144 (RHEL-256304) - Fix CVE-2026-86140 (RHEL-256027) - Fix CVE-2026-74860 (RHEL-256120) - Fix CVE-2026-86142 (RHEL-256365) - Fix CVE-2026-86143 (RHEL-256901) - Fix CVE-2026-86138 (RHEL-256953) - Fix CVE-2026-11979 (RHEL-215568) - Fix CVE-2026-6653 (RHEL-215619) - Fix CVE-2025-6170 (RHEL-182016) - Fix CVE-2024-34459 (RHEL-177882) - Rebuilt for the correct target in RHEL (9.7-z) (RHEL-119283) - Fix CVE-2025-9714 (RHEL-119283) - Fix CVE-2025-32415 (RHEL-100182) - Fix CVE-2025-32414 (RHEL-99873) - Fix CVE-2025-7425 (RHEL-102806) - Fix CVE-2025-6021 (RHEL-96507) - Fix CVE-2025-49794 (RHEL-96405) - Fix CVE-2025-49796 (RHEL-96431) - Rebase to 0.3.24 - Add missing libzstd-devel BuildRequires - Add missing files to the %files tests section - Resolves: RHEL-116442 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild for ICU 65 - Rebase to 1.5.5 Resolves: RHEL-62221 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - accel: ivpu: Update firmware for NPU (RHEL-38587) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw88: Add firmware v33.6.0 for RTL8814AE/RTL8814AU - rtw89: 8922a: update fw to v0.35.64.0 - rtw89: 8922a: update fw to v0.35.63.0 - rtw89: 8852c: update fw to v0.27.125.0 - iwlwifi: add Bz/gl FW for core94-91 release - iwlwifi: update ty/So/Ma firmwares for core94-91 release - iwlwifi: update cc/Qu/QuZ firmwares for core94-91 release - amdgpu: update psp 14.0.0 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update gc 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update vcn 3.1.2 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update navi10 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update gc 10.3.7 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - qcom: Update gpu firmwares for qcs8300 chipset - linux-firmware: add firmware for qat_420xx devices - amdgpu: DMCUB updates for various ASICs - i915: Update Xe3LPD DMC to v2.20 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250305133215 - mediatek MT7920: update bluetooth firmware to 20250210151502 - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - intel_vpu: Add firmware for 37xx and 40xx NPUs - QCA: Add Bluetooth firmwares for QCA2066 with USB transport - QCA: Add two bluetooth firmware nvm files for QCA2066 - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00653 - cirrus: cs35l41: Add firmware and tuning for ASUS Consumer laptops - cirrus: cs35l41: Add Firmware for various ASUS Commercial laptops - ASoC: tas2781: Update dsp firmware for Gemtree project - xe: Update GUC to v70.40.2 for BMG, LNL - amdgpu: DMCUB updates for various ASICs - amdgpu: DCUB update for DCN401 and DCN315 - cirrus: cs35l41: Add firmware and tunings for CS35L41 driver for Steam Deck - ath11k: QCN9074 hw1.0: update to WLAN.HK.2.9.0.1-02175-QCAHKSWPL_SILICONZ-2 - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04604-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA6698AQ hw2.1: update board-2.bin - rtw89: 8852bt: update fw to v0.29.122.0 and BB parameter to 07 - linux-firmware: Update AMD SEV firmware - linux-firmware: update firmware for MT7920 WiFi device - qca: update WCN3988 firmware - amdgpu: Update ISP FW for isp v4.1.1 - qcom: add firmware for Adreno A225 - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for two HP laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Add and update firmware for Cirrus CS35L56 for various Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for en8811h 2.5G ethernet phy - i915: Update Xe3LPD DMC to v2.17 - ASoC: tas2781: Change regbin firmwares for single device Resolves: RHEL-38587 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-87565) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel_vpu: Update NPU firmware - intel: avs: Update topology file for Digital Microphone Array - amdgpu: updates for dcn 3.20 and dcn 4.01 firmware to 0.1.10.0 - linux-firmware: Amphion: Update vpu firmware - amd_pmf: Update AMD PMF TA Firmware to v3.1 - amdgpu: update dcn 4.01 firmware to 0.1.8.0 - qcom: Add link for SM8350 GPU firmware - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56: Update firmware for Cirrus Amps for some Dell laptops - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250425073330 - rtw89: 8852c: add tables for dynamic antenna TXPWR - rtw89: 8922a: update fw to v0.35.71.0 - brcm: Add NVRAM file for Radxa Rock Pi X mini PC - i915: Update Xe3LPD DMC to v2.23 - rtl_bt: Update RTL8852B BT USB FW to 0x098B_154B - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01300-QCAHKSWPL_SILICONZ-1 - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - ath12k: QCN9274 hw2.0: update board-2.bin - qcom: vpu: update video firmware binary for SA8775p - iwlwifi: add Bz/gl FW for core95-82 release - iwlwifi: update ty/So/Ma firmwares for core95-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core95-82 release - iwlwifi: add Bz-hr FW for core93-123 release - qcom: add QUPv3 firmware for QCS9100 platform - ASoC: tas2781: Swap channel for SPI projects. - bmi260: Add BMI260 IMU initial configuration data file - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x1881_BA06 - rtw89: 8922a: update element RF TXPWR to R40 - rtw89: 8852c: update element RF TXPWR to R78 - rtw89: 8852c: add fw v0.27.125.0 with format version 2 - Revert "rtw89: 8852c: update fw to v0.27.125.0" - qcom: vpu: add video firmware binary for qcm6490 - contrib: process_linux_firmware: set user agent - amdgpu: update vcn 4.0.5 firmware - amdgpu: update psp 14.0.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update psp 13.0.4 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update yellow carp firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vega20 firmware - amdgpu: update navi14 firmware - amdgpu: update vega12 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update vega10 firmware - amdgpu: update psp 13.0.5 firmware - amdgpu: update navi12 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi10 firmware - amdgpu: update vangogh firmware - amdgpu: update picasso firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update arcturus firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige goby firmware - amdgpu: update psp 13.0.8 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: update dcn 4.01 frmware to 0.1.6.0 - intel: ish: Update license file for ISH - intel: avs: Update topology file for I2S Analog Devices 4567 - intel: avs: Update topology file for I2S Realtek 5663 - intel: avs: Update topology file for I2S Realtek 5640 - intel: avs: Update topology file for I2S Realtek 5514 - intel: avs: Update topology file for I2S Realtek 298 - intel: avs: Update topology file for I2S Realtek 286 - intel: avs: Update topology file for I2S Realtek 274 - intel: avs: Update topology file for I2S Nuvoton 8825 - intel: avs: Update topology file for I2S Maxim 98927 - intel: avs: Update topology file for I2S Maxim 98373 - intel: avs: Update topology file for I2S Maxim 98357a - intel: avs: Update topology file for HDAudio codecs - intel: avs: Update topology file for HDMI codecs - intel: avs: Update topology file for Digital Microphone Array - intel: avs: Update topology file for I2S Dialog 7219 - xe: Update GUC to v70.44.1 for BMG and LNL - i915: Update GUC to v70.44.1 for i915 platforms - qcom:x1e80100: Iris Support for Lenovo T14s G6 Qualcomm platform - qcom:x1e80100: Support for Lenovo Yoga Slim 7 Snapdragon platform - Mellanox: Add new mlxsw_spectrum firmware xx.2014.4012 - linux-firmware: add firmware for Aeonsemi AS21x1x 1G/2.5G/5G/10G Ethernet Phy - QCA: Add 8 bluetooth nvm files for WCN785x btusb - QCA: Update WCN785x btusb firmware to 2.0.0-00790-3 - qcom: update firmware binary for SM8250 - mediatek: Add new mt8195 SOF firmware - mediatek: Add new mt8188 SOF firmware - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x17E9_16ED - Revert "rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6" - intel_vpu: Update NPU firmware - cirrus: cs35l56: Correct filenames of SSID 103c8e1b and 103c8e1c - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x0471_70A6 - amdgpu: update dcn 3.5 and dcn 3.5.1 firmware to 9.0.27.0 - amdgpu: update dcn 3.1.4 firmware to 8.0.78.0 - amdgpu: update dcn 4.01 firmware to 0.1.3.0 - amdgpu: update dcn 3.5 firmware to 0.1.0.0 - cirrus: cs35l41: Add Firmware for various HP Laptops using CS35L41 HDA - cirrus: Add cs35l56 firmware symlinks for Asus UM5606KA - qcom: Add DSP firmware for QCS8300 platform - mediatek: Add MT8188 SCP firmware - copy-firmware: fail gracefully if moreutils parallel is installed - copy-firmware: make script smarter about bad parameters - copy-firmware: add usage help text - linux-firmware: Update firmware file for Intel BlazarI core - qcom: Add Audio firmware for Lenovo Slim 7x - qcom: Add Audio firmware for Lenovo T14s - amdgpu: DMCUB updates for various ASICs Resolves: RHEL-87565 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - xe: Update GUC to v70.45.2 for BMG, LNL - i915: Update GUC to v70.45.2 for DG2 - xe: Update LNL GSC to v104.0.5.1429 - amdgpu: DMCUB updates for various ASICs - qcom: add QUPv3 firmware for QCS8300 platform - Intel IPU7: Add firmware binary files - ice: update wireless_edge package to 1.3.23.0 - ice: update comms package to 1.3.55.0 - ice: update package to 1.3.43.0 - linux-firmware: Update firmware file for Intel Pulsar core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel Quasar core - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - iwlwifi: add Bz/gl FW for core96-76 release - iwlwifi: update ty/So/Ma firmwares for core96-76 release - iwlwifi: update cc/Qu/QuZ firmwares for core96-76 release - iwlwifi: update firmwares for 8000 series - iwlwifi: update 7265D firmware - mediatek MT7925: update bluetooth firmware to 20250526153203 - linux-firmware: update firmware for MT7925 WiFi device - qcom: sc8280xp: FW blob updates for X13s - brcm: Add symlinks for Khadas VIM SDIO wifi config to AW-CM256SM.txt - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 - cirrus: cs35l41: Fix firmware links for several ASUS laptops - cirrus: cs35l41: Add Firmware for various HP Agusta Laptops using CS35L41 HDA - Adjust QUPv3 driver name - cnm: Add Chips&Media wave633c firmware for NXP i.MX9 - qcom: add QUPv3 firmware for QCM6490 platform - mediatek: Add mt8196 VCP firmware - cirrus: cs35l41: Add Firmware for various ACER Laptops using CS35L41 HDA - nvidia: add GSP-RM version 570.144 firmware images - amdgpu: DMCUB updates for various ASICs - powervr: add firmware for Imagination Technologies BXS-4-64 GPU - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x7C20 - brcmfmac: Add a couple of NanoPi devices - rtl_nic: add firmware rtl8127a-1 - cnm: update chips&media wave521c firmware. Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - Update linux-firmware to latest upstream (RHEL-95338) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtw89: 8852b: update fw to v0.29.128.0 - rtw89: 8852bt: update fw to v0.29.127.0 - rtw89: 8922a: add regd fw element with version R72-R6 - rtw89: 8852c: add regd fw element with version R72-R57 - rtw89: 8922a: update BB parameter V49 - qcom: Update gpu firmwares of QCS615 chipset - linux-firmware: Update firmware file for Intel Solar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - xe: Add fan_control v203.0.0.0 for BMG - linux-firmware: Update AMD cpu microcode - amdgpu: Add DCN 3.6 - amdgpu: Add PSP 14.0.5 - amdgpu: Add SDMA 6.1.3 - amdgpu: Add GC 11.5.3 - mediatek MT7921: update bluetooth firmware to 20250625154126 - qcom/adreno: document firmware revisions - qcom/adreno: move A610 and A702 ZAP files to Adreno driver section - qcom: Add sdx61 Foxconn vendor firmware image file - Revert "linux-firmware: Update firmware file for Intel Pulsar core" - qcom/adreno: sort entries in WHENCE - xe: First HuC release for Pantherlake - xe: First GuC release for Pantherlake - linux-firmware: update firmware for MT7921 WiFi device - rtw89: 8922a: update fw to v0.35.80.0 - rtw89: 8852c: update fw to v0.27.129.1 - rtw89: 8852c: update fw to v0.27.128.0 - WHENCE: extract license texts - WHENCE: expand the advansys license statement - WHENCE: some older AMD drivers are MIT licensed - qcom: update firmware binary for SM8550 - amdgpu: DMCUB updates for DCN401 - qcom: venus-5.4: add the firmware binary for qcs615 - Revert "qcom: Add sdx61 Foxconn vendor firmware image file" - amdgpu: update dmcub fw for dcn401 - qcom: Add sdx61 Foxconn vendor firmware image file - brcm: Fix symlinks for Khadas VIM SDIO wifi config - amdgpu: update renoir firmware - amdgpu: update vcn 5.0.0 firmware - amdgpu: update smu 14.0.3 firmware - amdgpu: update sdma 7.0.1 firmware - amdgpu: update psp 14.0.3 firmware - amdgpu: update gc 12.0.1 firmware - amdgpu: update navy flounder firmware - amdgpu: update psp 14.0.4 firmware - amdgpu: update gc 11.5.2 firmware - amdgpu: update sienna cichlid firmware - amdgpu: add raven2 ip discovery firmware - amdgpu: update smu 14.0.2 firmware - amdgpu: update sdma 7.0.0 firmware - amdgpu: update psp 14.0.2 firmware - amdgpu: update gc 12.0.0 firmware - amdgpu: update vcn 4.0.6 firmware - amdgpu: update psp 14.0.1 firmware - amdgpu: update gc 11.5.1 firmware - amdgpu: update psp 13.0.11 firmware - amdgpu: update gc 11.0.4 firmware - amdgpu: add picasso ip discovery firmware - amdgpu: add raven ip discovery firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update vcn 4.0.4 firmware - amdgpu: update psp 13.0.7 firmware - amdgpu: update gc 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update vega10 firmware - amdgpu: update gc 10.3.6 firmware - amdgpu: update smu 13.0.10 firmware - amdgpu: update psp 13.0.10 firmware - amdgpu: update gc 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: add smu 13.0.0 kicker firmware - amdgpu: add psp 13.0.0 kicker firmware - amdgpu: add gc 11.0.0 kicker firmware - amdgpu: add vcn 5.0.1 firmware - amdgpu: add sdma 4.4.4 firmware - amdgpu: add psp 13.0.12 firmware - amdgpu: add gc 9.5.0 firmware - amdgpu: add arcturus IP discovery firmware - amdgpu: update vcn 4.0.0 firmware - amdgpu: update smu 13.0.0 firmware - amdgpu: update psp 13.0.0 firmware - amdgpu: update gc 11.0.0 firmware - amdgpu: update psp 13.0.14 firmware - amdgpu: update gc 9.4.4 firmware - amdgpu: update psp 13.0.6 firmware - amdgpu: update gc 9.4.3 firmware - amdgpu: update beige_goby firmware - amdgpu: update vcn 4.0.5 firmware - amdgpu: update gc 11.5.0 firmware - amdgpu: update vcn 4.0.2 firmware - amdgpu: update gc 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - WHENCE: fix subtly incorrect licensing - amdgpu: update dmcub fw for dcn32 and dcn401 - mediatek: Update mt8186 SCP firmware - amdgpu: Update DMCUB fw for DCN401 & DCN315 - WHENCE: unify Driver statements - qcom: add gpu firmwares for X1P42100 chipset - QCA: Update WCN785x btusb firmware to 2.0.0-00799-5 - rtl_nic: update firmware of RTL8153A - qcom: sc8280xp: Updated power FW for X13s - linux-firmware: update firmware for MT7986 - linux-firmware: update firmware for MT7981 - linux-firmware: update firmware for MT7916 - cirrus: cs35l41: Add Firmware for ASUS NUC using CS35L41 - Revert "iwlwifi: add Bz/gl FW for core96-76 release" - amdgpu: DMCUB updates for various ASICs - mediatek MT7922: update bluetooth firmware to 20250523103438 - mediatek MT7921: update bluetooth firmware to 20250523111333 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7921 WiFi device Resolves: RHEL-95338 - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream () - Update linux-firmware to latest upstream (RHEL-145341) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops - Intel IPU7: Update firmware binary for Panther Lake - linux-firmware: update firmware for MT7921 WiFi device - amdgpu: DMCUB updates for various ASICs - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F - linux-firmware: Add firmware for airoha-npu-7583 driver - iwlwifi: add Bz/Sc FW for core102-56 release - iwlwifi: Add Hr/Gf firmware for core102-56 release - iwlwifi: update ty/So/Ma firmwares for core102-56 release - xe: Add GSC 105.0.2.1301 for PTL - mediatek: rename MT8188 SCP firmware - qcom: Update DSP firmware for QCM6490 platform - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20260106153314 - mediatek MT7920: update bluetooth firmware to 20260105151350 - mediatek MT7922: update bluetooth firmware to 20260106153735 - linux-firmware: update firmware for MT7922 WiFi device - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900 - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0 - qcom: Update DSP firmware for sa8775 platform - QCA: Add Bluetooth firmware for QCC2072 uart interface - i915: Xe3p_LPD DMC v2.33 - qcom: Update DSP firmware for qcs8300 platform - linux-firmware: update firmware for MT7920 WiFi device Resolves: RHEL-145341 - Update linux-firmware to latest upstream (RHEL-139962) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - qcom: Update aic100 firmware files - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105 - firmware: Revert kernel_boot.elf due to license compliance issue - linux-firmware: add firmware for an8811hb 2.5G ethernet phy - i915: Xe3LPD_3002 DMC v2.28 - i915: Xe3LPD DMC v2.33 - intel_vpu: Add firmware for 50xx NPUs and update older ones - linux-firmware: Update AMD SEV firmware - amdgpu: DMCUB updates for various ASICs - qcom: venus-5.4: fix ELF segment alignment to 4 bytes - mediatek MT7925: update bluetooth firmware to 20251210093205 - linux-firmware: update firmware for MT7925 WiFi device - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller - qcom: Update CDSP firmware for qcm6490 platform - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55 - linux-firmware: Add firmware file for Intel Scorpius core - rtw89: 8852b: update fw to v0.29.29.15 - cirrus: cs35l41: Update firmware and tuning for various HP laptops - cirrus: cs35l41: Add support for new HP Clipper laptop - qcom: drop compatibility a640_zap.mdt symlink - qcom: add version for a530v3_gpmu.fw2 - xe: Update GUC to v70.55.3 for BMG, PTL - iwlwifi: add Bz/Sc FW for core101-82 release - iwlwifi: Add Sc/Gf firmware for core101-82 release - iwlwifi: update ty/So/Ma firmwares for core101-82 release - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release - amdgpu: DMCUB updates for various ASICs - qcom: Add firmwares for sm8150 GPU - qcom: Add firmwares for sm8450 GPU - qcom: Add firmwares for sm8550 GPU - qcom: Add firmwares for sm8650 GPU - qcom: Add firmwares for sm8750 GPU - Makefile: add licence header - ath10k: WCN3990 hw1.0: update board-2.bin - ath10k: QCA9888 hw2.0: update board-2.bin - ath10k: QCA4019 hw1.0: update board-2.bin - cirrus: cs35l41: Add support for new HP laptops - Revert "amdgpu: update GC 11.5.0 firmware" - linux-firmware: Update amd-ucode copyright information - linux-firmware: Update AMD cpu microcode - linux-firmware: Update firmware file for Intel Scorpius core - linux-firmware: Update firmware file for Intel BlazarIGfP core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core - linux-firmware: Update firmware file for Intel BlazarU core - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: update ADSP firmware for x1e80100 platform, change the license - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE - Reapply "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update SMU 14.0.3 firmware" - Revert "amdgpu: update GC 10.3.6 firmware" - Revert "amdgpu: update GC 11.5.1 firmware" - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251124093155 - intel_vpu: Update NPU firmware - WHENCE: fix version string for video firmware - qcom: vpu: update video firmware binary for SM8250 - xe: Update GUC to v70.54.0 for BMG, PTL - Revert "amdgpu: update GC 11.0.1 firmware" - QCA: Add Bluetooth firmware for WCN685x uart interface - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3 - qcom: venus-5.4: update firmware binary for v5.4 - qcom: venus-5.4: remove unused firmware file - iwlwifi: add Sc/Wh FW for core98-181 release - amdgpu: DMCUB updates for various ASICs - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04 - ASoC: tas2781: Add more symbol links on SPI devices - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SMU 14.0.3 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update smu 13.0.7 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update smu 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update SDMA 4.4.2 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update aldebaran firmware - amdgpu: add vce1 firmware - mediatek MT7922: update bluetooth firmware to 20251118163447 - linux-firmware: update firmware for MT7922 WiFi device - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license - qcom: add ADSP, CDSP firmware for sm8750 platform - rtl_nic: add firmware rtl9151a-1 - qcom: Update aic100 firmware files - mt76: add firmware for MT7990 - mt76: update firmware for MT7992 - mt76: update firmware for MT7996 - cirrus: cs35l57: Add firmware for a few Dell products - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec - qcom: Add sdx35 Foxconn vendor firmware image file - linux-firmware: Update AMD cpu microcode Resolves: RHEL-139962 - Update linux-firmware to latest upstream (RHEL-128087) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905 - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy - rtw88: 8822b: Update firmware to v30.20.0 - rtl_nic: add firmware rtl8125k-1 - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - ASoC: tas2781: Update dsp firmware for HP and ASUS projects - amdgpu: DMCUB updates for various ASICs - amdgpu: DMCUB updates for various ASICs - qcom: add SOCCP firmware for kaanapali platform - xe: Update GUC to v70.53.0 for BMG, LNL, PTL - i915: Update GUC to v70.53.0 for DG2, MTL - rtw89: 8851b: update fw to v0.29.41.5 - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2 - rtw89: 8852b: update fw to v0.29.29.14 - Revert "rtw89: 8852b: update fw to v0.29.128.0" - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1 - rtw89: 8852bt: update fw to v0.29.122.1 - Revert "rtw89: 8852bt: update fw to v0.29.127.0" - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it - amdgpu: DMCUB updates for various ASICs - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin - linux-firmware: Update AMD cpu microcode - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20251015213201 - rtl_bt: Add firmware and config files for RTL8761CUV - linux-firmware: Update AMD cpu microcode - qcom: add ADSP firmware for kaanapali platform - amdgpu: DMCUB updates for various ASICs - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system. - mediatek MT7920: update bluetooth firmware to 20251020151255 - linux-firmware: update firmware for MT7922 WiFi device - linux-firmware: update firmware for MT7920 WiFi device - amd-ucode: Fix minimum revisions in README - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID - mediatek MT7922: update bluetooth firmware to 20251020143443 - Revert "linux-firmware: update firmware for MT7922 WiFi device" - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659 - iwlwifi: add Bz/Fm and gl FW for core98-161 release - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release - iwlwifi: update ty/So/Ma firmwares for core98-161 release - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release - intel: qat: Fix missing link - amdgpu: DMCUB updates for various ASICs - nvidia: add generic bootloader for GSP-enabled systems - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build - qcom: vpu: rename firmware binaries - Intel IPU7: Update product signed firmware binary - i915: Xe2LPD DMC v2.29 - i915: Xe3LPD DMC v2.32 - i915: Xe3LPD_3002 DMC v2.27 - WHENCE: nvidia: rearrange GSP-RM firmware lines - linux-firmware: Add ISH firmware file for Intel Pather Lake platform - linux-firmware: Update firmware file for Intel Magnetar core - linux-firmware: Update firmware file for Intel BlazarU core - linux-firmware: Update firmware file for Intel BlazarI core - qcom: add CDSP firmware for kaanapali platform - qcom: add version for A650 GMU firmware - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100 - qcom: Add firmwares for Kaanapali GPU - qcom: Update A623 GMU fw - qcom: Fix QCS615 chipset's GPU secure fw - qcom: Update DSP firmware for sa8775p platform - amdgpu: DMCUB updates for various ASICs - WHENCE: remove link for Kaanapali video firmware - intel_vpu: Update NPU firmware - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems - Update VCN for Navi1x, Green Sardine and Renoir - WHENCE: extract multitech license text - WHENCE: extract ueagle license - WHENCE: use LICENCE.sensoray for s2255drv - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray - WHENCE: clean up emi62 and yam license statements - qcom: vpu: update video firmware binary for SM8550 - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA - qcom: vpu: add video firmware for Kaanapali - qcom: Update DSP firmware for qcs8300 platform. - qcom: Add Audio topology for HAMOA-EVK - intel/ish:Add ISH firmware file for Intel Lunar Lake platform - mediatek: update firmware version info for MT7986/81/16 - linux-firmware: ql2500_fw: update ISP25xx Firmware - qcom: Update aic100 firmware files - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a - amdgpu: DMCUB updates for various ASICs - mediatek: mtk_wed: drop links for mt7988 - Revert "amdgpu: update gc 10.3.6 firmware" - qcom: Update DSP firmware for qcs8300 platform. - powervr: update firmware for Imagination Technologies BXS-4-64 GPU - qcom: Update DSP firmware for sa8775p platform. - amdgpu: DMCUB updates for various ASICs - ath12k: WCN7850 hw2.0: update board-2.bin - qcom: move LEMANS EVK firmware to correct location - amdgpu: update PSP 14.0.3 kicker firmware - amdgpu: update vega20 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update vangogh firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update VPE 6.1.0 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update renoir firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update SMU 14.0.2 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update SMU 13.0.10 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update SMU 13.0.0 kicker firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update SMU 13.0.0 firmware - amdgpu: update PSP 13.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update beige goby firmware - amdgpu: update dimgrey cavefish firmware - amdgpu: update navy flounder firmware - amdgpu: update sienna cichlid firmware - amdgpu: update navi14 firmware - amdgpu: update navi12 firmware - amdgpu: update navi10 firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update GC 9.4.4 firmware - amdgpu: update SDMA 6.1.3 firmware - amdgpu: update PSP 14.0.5 firmware - amdgpu: update GC 11.5.3 firmware - amdgpu: update VPE 6.1.3 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update green sardine firmware - amdgpu: update VCN 4.0.3 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - linux-firmware: update firmware for en8811h 2.5G ethernet phy - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - mediatek MT7922: update bluetooth firmware to 20250903123504 - linux-firmware: update firmware for MT7922 WiFi device - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir - qcom: Add Audio topology for MONACO-EVK - qcom: add CDSP firmware for qcs615 platform - qcom: Add Audio topology for LEMANS-EVK - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices. - qcom: vpu: update firmware binaries to fix encoder drain handling - intel_vpu: Update NPU firmware - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers" - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers - xe: Update GUC to v70.49.4 for BMG, LNL, PTL - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL - qcom: add ADSP firmware for qcs615 platform - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962 - iwlwifi: add Bz-HR FW for core90-93 release - Fix link entry for qat_895xcc.bin - Move QAT firmware to intel/ subdirectory - Move all iwlwifi top level files to intel/ directory - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10" - ath11k: Support WCN6855 hw2.1 with NFA firmware variant - amdgpu: Update ISP FW for isp v4.1.1 - Update README.md to clarify S-o-b requirements - firmware: qcom: Reorder VPU firmware entries in WHENCE - intel_vpu: Update NPU firmware - amdgpu: DMCUB updates for various ASICs - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10 - cirrus: cs35l41: Move entries to correct driver section in WHENCE - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops - qcom: Add firmware binary for SM8650. - Link rtl8723b_config.bin to rtl8723bs - rtw89: 8922a: update fw to v0.35.80.3 - rtw89: 8852c: update fw to v0.27.129.4 - rtw89: 8852c: update fw to v0.27.129.3 - qcom: add CDSP firmware for x1e80100 platform - iwlwifi: add Bz/gl FW for core97-84 release - iwlwifi: update ty/So/Ma firmwares for core97-84 release - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release - amdgpu: DMCUB updates for various ASICs - realtek: rt1321: Add patch firmware of MCU - mediatek: Add MT8189 SCP firmware Resolves: RHEL-128087 - Update linux-firmware to latest upstream (RHEL-108845) Changes since the last update are noted on items below, copied from the git changelog of upstream linux-firmware repository. - amdgpu: DMCUB updates for various ASICs - panthor: Add firmware for more Mali GPUs - amdgpu: update renoir firmware - amdgpu: add SMU 14.0.3 kicker firmware - amdgpu: add PSP 14.0.3 firmware - amdgpu: add GC 12.0.1 kicker firmware - amdgpu: update navy flounder firmware - amdgpu: update SDMA 6.1.2 firmware - amdgpu: update PSP 14.0.4 firmware - amdgpu: update GC 11.5.2 firmware - amdgpu: update yellow carp firmware - amdgpu: update VCN 5.0.0 firmware - amdgpu: update SDMA 7.0.1 firmware - amdgpu: update PSP 14.0.3 firmware - amdgpu: update GC 12.0.1 firmware - amdgpu: update sienna cichlid firmware - amdgpu: update vega20 firmware - amdgpu: update SDMA 7.0.0 firmware - amdgpu: update PSP 14.0.2 firmware - amdgpu: update GC 12.0.0 firmware - amdgpu: update vega12 firmware - amdgpu: update vega10 firmware - amdgpu: update VCN 3.1.2 firmware - amdgpu: update PSP 13.0.5 firmware - amdgpu: update GC 10.3.6 firmware - amdgpu: update VCN 4.0.4 firmware - amdgpu: update SDMA 6.0.2 firmware - amdgpu: update PSP 13.0.7 firmware - amdgpu: update GC 11.0.2 firmware - amdgpu: update navi14 firmware - amdgpu: update SDMA 6.0.3 firmware - amdgpu: update PSP 13.0.10 firmware - amdgpu: update GC 11.0.3 firmware - amdgpu: update navi12 firmware - amdgpu: update vangogh firmware - amdgpu: update navi10 firmware - amdgpu: update PSP 13.0.0 kicker firmware - amdgpu: update VCN 5.0.1 firmware - amdgpu: update PSP 13.0.12 firmware - amdgpu: update GC 9.5.0 firmware - amdgpu: update VCN 4.0.0 firmware - amdgpu: update SDMA 6.0.0 firmware - amdgpu: update GC 11.0.0 firmware - amdgpu: update PSP 13.0.14 firmware - amdgpu: update PSP 13.0.6 firmware - amdgpu: update GC 9.4.3 firmware - amdgpu: update vpe 6.1.1 firmware - amdgpu: update VCN 4.0.6 firmware - amdgpu: update SDMA 6.1.1 firmware - amdgpu: update PSP 14.0.1 firmware - amdgpu: update GC 11.5.1 firmware - amdgpu: update PSP 13.0.11 firmware - amdgpu: update GC 11.0.4 firmware - amdgpu: update beige goby firmware - amdgpu: update PSP 13.0.8 firmware - amdgpu: update GC 10.3.7 firmware - amdgpu: update VCN 4.0.5 firmware - amdgpu: update PSP 14.0.0 firmware - amdgpu: update GC 11.5.0 firmware - amdgpu: update VCN 4.0.2 firmware - amdgpu: update SDMA 6.0.1 firmware - amdgpu: update PSP 13.0.4 firmware - amdgpu: update GC 11.0.1 firmware - amdgpu: update dimgrey_cavefish firmware - amdgpu: update aldebaran firmware - qca: Update Bluetooth WCN6750 1.1.3-00069 firmware to 1.1.3-00091 - qcom: Add QDSP firmware file for Qualcomm QDU100 device. - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3 - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 - ath11k: WCN6855 hw2.0: update board-2.bin - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04650-QCAHSPSWPL_V1_V2_SILICONZ_IOE-2 - ath11k: QCA2066 hw2.1: update to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.9 - ath11k: QCA2066 hw2.1: update board-2.bin - qcom: Update xbl_config firmware file. - amdgpu: Update GCN 4.0.5 microcode - amdgpu: Update SDMA 6.1.0 microcode - amdgpu: Update GC 11.5.0 microcode - qcom: Add QDU100 firmware image files required for booting. - linux-firmware: Add firmware for airoha-npu driver - linux-firmware: update firmware for MT7925 WiFi device - mediatek MT7925: update bluetooth firmware to 20250721233113 - qcom: Update DSP firmware for qcm6490 platform - qcom: update Venus firmware file for v6.0 - i915: Xe3LPD DMC v2.29 - linux-firmware: Update AMD cpu microcode - qcom: Add QCS6490 symlink for QUPv3 firmware - qcom: Add firmware binary for SM8750. - amdgpu: update dmcub fw for dcn314 - cirrus: cs35l41: Add Firmware for various ASUS commercial Laptops using CS35L41 HDA - cirrus: cs35l41: Update Firmware for Dell Oasis - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various Dell laptops - qcom: Add Audio topology for QCS6490 RB3Gen2 - intel_vpu: Update NPU firmware - amdgpu: update dmcub fw for various DCN version - WHENCE: extract more license statements - WHENCE: clarify io_ti origin - amdgpu: Update GC 11.5.1 microcode Resolves: RHEL-108845 - do not remove config when stopping lldpad (RHEL-61874) - Rebase to latest upstream code - Remove interface configure if the interface deleted (RHEL-13242) - Fix strdup is not freed (RHEL-37524) - Fix using uninitialized value (RHEL-37548) - Fix copy past error (RHEL-37679) - Fix resource leak (RHEL-37685) - Update gating test - Rebase to 1.1.1 - Fix program segfaults after entering the quit command (RHEL-5814) - Fix setting interface status not survive reboot (RHEL-5824) - Fix some other bugs - Convert the license tag to SPDX format (RHELMISC-1358) - Remove compat libs for LLVM 20 - Update LLVM Toolset to 21.1.8 [rhel-9] - Update to 21.1.7 - Backport fix for pgo optimized rust toolchain on ppc64le (rhbz#2382683) - Backport fix for crbit spill miscompile on ppc64le power9 and power10 (rhbz#2383037) - Backport fix for build of highway package on ppc64le (rhbz#2383182) - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Update to LLVM 20.1.8 - Add riscv64 enablement bits; thanks: Songsong Zhang (U2FsdGVkX1@gmail.com) and David Abdurachmanov (davidlt@rivosinc.com) - Update to LLVM 20.1.7 - Fix llvm-config alternatives handling (rhbz#2361779) - Use libdir suffix in versioned prefix - Update to 14.0.6 - Update to 14.0.5 - Remove llvm-cmake-devel package - Update to 14.0.0 - 13.0.1 Release - 13.0.0 Release - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - 12.0.1 Release - Remove llvm11 compat package - Fix DTRACE_PROBE4() compilation failure - Remove llvm 18 compat lib * Update to LLVM 19.1.7 (RHEL-57460) - Disable libomp tests on s390x RHEL entirely. - Update to 19.1.5 - Enable LLVM_ENABLE_ZSTD (rhbz#2321848) - Remove HTML documentation - Add lldb man pages - Fix profiling after a binutils NOTE change (rhbz#2322754) - Install i386 config files on x86_64 - Update to 19.1.3 - Workaround for GFX11.5 export priority (RHEL-49517) - Remove llvm 17 compat lib - Update to LLVM 18.1.8 - Fix use after free on ppc64le (rhbz#2283525) - Turn on build condition bundle_compat_lib by default - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Upgrade to version 0.9.29 - Upgrade to version 0.9.28 - Specfile refactoring - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Upgrade to version 0.9.27 - Upgrade to version 0.9.26 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Upgrade to version 0.9.25 - Use OpenLDAP git directly in place of GitHub mirror - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Update to upstream version 2.17.2 - Re-add log4j-web subpackage - Remove glyphicons resources from source package - Fix compatibility with OpenJDK 8 - Remove dependency on jackson - Update log4j to 2.17.1 for CVE-2021-44832 RCE via JDBC Appender (when attacker controls config) - Update log4j to 2.17.0 for CVE-2021-45105 Denial of Service attack - Update log4j to 2.16.0 - Disables JNDI by default - Update log4j to 2.15.0 (#2030907) - Security fix for CVE-2021-44228 (#2030945) - Update to 2.14.1 - Disable javadoc (#1988896) - Build with jansi-2 - Remove deps on slf4j-ext (no longer available in Fedora 35) - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Drop explicit requires on javapackages-tools - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + low-memory-monitor-2.1-1 - Update to 2.1 - Don't poke at sysrq proc file (#1898524) + low-memory-monitor-2.0-6 - Reload presets when updating from an older version to enable daemon - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + low-memory-monitor-2.0-3 - Disable OOM killer by default for now - Import into Fedora (#1769843) + low-memory-monitor-2.0-2 - Rename -docs subpackage to -doc + low-memory-monitor-2.0-1 - Update to 2.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Disable bootstrap mode forgotten on 5.4 rebase (#2135419) - Apply upstream patch for CVE-2022-28805 - Resolves CVE-2021-43519 - Rebase to lua 5.4.4 - Resolves CVE-2021-44964 - Fix up CVE-2022-33099 patch - Enable gating - apply upstream fix for CVE-2022-33099 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Fix false positive warnings about stray FDs on s390x. - Handle wrong XFS reported size when shrinking LV immediately after growing. - Allow integrity to use multiple segments for metadata. - Add message when activating RAID volumes with snapshots. - Update to upstream version 2.03.33. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix cve-2021-3520 resolves: cve-2021-3520 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.9.3 and switch to Meson - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.9.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1961997 - minglish file permission fix - Resolves:rhbz#1961997 - Add gating tests from rhel-8 - Malayalam Mozhi input scheme bug fix - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make_build and make_install macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix mni-inscript2-{beng,mtei}.mim and sat-inscript2-{deva,olck}.mim - Add si-sayura.mim input method - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1961997 - minglish file permission fix - Resolves:rhbz#1961997 - Add gating tests from rhel-8 - Malayalam Mozhi input scheme bug fix - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make_build and make_install macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix mni-inscript2-{beng,mtei}.mim and sat-inscript2-{deva,olck}.mim - Add si-sayura.mim input method - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1967892 - Add conditional for anthy module subpackage - Resolves:rhbz#1961998 - Add gating tests from rhel-8 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1967892 - Add conditional for anthy module subpackage - Resolves:rhbz#1961998 - Add gating tests from rhel-8 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Don't try to execute directories (RHEL-22829) - Initial commit for make-latest.el9 - Ensure that we can transition from make-latest to make - Rebase to make 4.4 - Handle SIGPIPE as a fatal signal - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to make 4.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add SCL compatibility to LTS builds. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.8.4 - Do not override JAVA_HOME set by user - Resolves: rhbz#2020478 - Suggest OpenJDK 17 as default Maven binding - Add OpenJDK 17 binding - Create a symlink to jansi shared object - Related: rhbz#1994935 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.1.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.1.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.5.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 3.5.1. - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.6.2 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.6.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to version 3.5.1. - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.5.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 3.5.1. - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.6.2 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.6.1 - Update javapackages test plan to f42 - Set Java compiler source/target via javaVersion property - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to maven 3.8.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 0.13.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Set Java compiler source/target via javaVersion property - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 0.13.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to upstream version 0.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to maven 3.8.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 0.13.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 3.3.0 - Update to version 3.3.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 3.7.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 3.3.0 - Update to version 3.3.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 3.7.1 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove Provides/Obsoletes on maven-plugin-bundle-javadoc - Update javapackages test plan to f42 - Fix Maven compiler target setting - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 5.1.9 - Remove Provides/Obsoletes on maven-plugin-bundle-javadoc - Update javapackages test plan to f42 - Fix Maven compiler target setting - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 5.1.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.1.1 - Update to version 3.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.4.0 - Resolves: rhbz#2291028 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to upstream version 3.1.1 - Update to version 3.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.1.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.1.1 - Update to version 3.1.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.4.0 - Resolves: rhbz#2291028 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.10.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.10.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add patch for NPE during testCompile - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.3 - Update to version 1.11.3. - Update to upstream version 1.11.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.3 - Update to version 1.11.3. - Update to upstream version 1.11.2 - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 1.13.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.3 - Update to version 1.11.3. - Update to upstream version 1.11.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.12.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.11.3 - Update to version 1.11.3. - Update to upstream version 1.11.2 - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 1.13.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.1.2 - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.1.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.3.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.1.2 - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Remove dependency on apache-commons-lang3 - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.6.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.1.2 - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.1.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.3.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.1.2 - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Remove dependency on apache-commons-lang3 - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.6.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.1.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.1.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove obsolete patches - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.0.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2283957 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove obsolete patches - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.0.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2283957 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove obsolete patches - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.0.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2283957 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove obsolete patches - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.0.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.0.0-M3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2283957 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove obsolete patches - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.0.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2283957 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove obsolete patches - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.0.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2283957 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add boolean dependencies between plugin and provider subpackages - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Use upstream Java compiler source/target/release - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Use upstream Java compiler source/target/release - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.2.0 - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Non-bootstrap build - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.2.0 - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.2.0 - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to upstream version 3.2.0 - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add maven-openjdk25 binding - Implement new non-conflicting Java bindings - Resolves: RHEL-54068, RHEL-54070, RHEL-54071, RHEL-54072 - Add noarch to ExclusiveArch - Disable building on i686 - Switch to Fedora tests - Fix patch usage - Rebuild with regenerated Requires on Java - Suggest maven-openjdk17 - Resolves: RHEL-62398 - Add maven-openjdk21 - Resolves: RHEL-62407 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.8.4 - Do not override JAVA_HOME set by user - Resolves: rhbz#2020478 - Suggest OpenJDK 17 as default Maven binding - Add OpenJDK 17 binding - Create a symlink to jansi shared object - Related: rhbz#1994935 - Rebuild to regenerate auto-requires - Add OpenJDK 21 binding - Related: RHEL-13046 - Turn hard dependency on java-devel into a weak dependencny - Resolves: rhbz#2165595 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Add maven-openjdk25 binding - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.8.4 - Do not override JAVA_HOME set by user - Resolves: rhbz#2020478 - Suggest OpenJDK 17 as default Maven binding - Add OpenJDK 17 binding - Create a symlink to jansi shared object - Related: rhbz#1994935 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.8.4 - Do not override JAVA_HOME set by user - Resolves: rhbz#2020478 - Suggest OpenJDK 17 as default Maven binding - Add OpenJDK 17 binding - Create a symlink to jansi shared object - Related: rhbz#1994935 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.8.4 - Do not override JAVA_HOME set by user - Resolves: rhbz#2020478 - Suggest OpenJDK 17 as default Maven binding - Add OpenJDK 17 binding - Create a symlink to jansi shared object - Related: rhbz#1994935 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add build-dependency on extra-enforcer-rules - Update to upstream version 3.8.5 - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 3.8.4 - Do not override JAVA_HOME set by user - Resolves: rhbz#2020478 - Suggest OpenJDK 17 as default Maven binding - Add OpenJDK 17 binding - Create a symlink to jansi shared object - Related: rhbz#1994935 - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 34 - Remove javadoc taglet configuration which is not longer available - Remove explicit requirement on maven-plugin-tools-javadoc - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 35 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 43 - Resolves: rhbz#2296838 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 41 - Rebuild - Update to upstream version 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.3.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 3.2.0. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 3.2.0. - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 3.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.3.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump release - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 5.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 5.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 4.2.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 5.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to maven 3.8.1 - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Fix Maven compiler target setting - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to maven 3.8.1 - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Fix Maven compiler target setting - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to maven 3.8.1 - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Fix Maven compiler target setting - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Use %autosetup -C - Update javapackages test plan to f42 - Drop unneeded Obsoletes - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Ignore jTidy crashes when generating maven plugin descriptors. - Disable beanshell modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.6.4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused ant scripting support. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Enable tests - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Enable tests - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Enable tests - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 1.7.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add aether-connector-wagon alias - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.3 - Remove use of deprecated SHA-1 and MD5 algorithms - Enable transport-file and transport-http module - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Add epoch to obsoleted packages - Obsolete removed subpackages - Update javapackages test plan to f42 - Update to upstream version 1.9.22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.9.18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add aether-connector-wagon alias - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.3 - Remove use of deprecated SHA-1 and MD5 algorithms - Enable transport-file and transport-http module - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Add epoch to obsoleted packages - Obsolete removed subpackages - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add aether-connector-wagon alias - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Update to upstream version 1.9.22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.9.18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Update javapackages test plan to f42 - Update to upstream version 1.9.22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.9.18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.2.0 - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.2.0 - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.2.0 - Update to version 3.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.2.4. - Update to version 3.2.3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Drop workaround for maven-artifact-transfer 0.11.0. - Update to version 3.2.1. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.2.4. - Update to version 3.2.3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Drop workaround for maven-artifact-transfer 0.11.0. - Update to version 3.2.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Remove unneeded dependency on plexus-component-api - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Fix Maven compiler target setting - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Fix Maven compiler target setting - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to upstream version 3.3.4 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to upstream version 3.3.4 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 3.2.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to upstream version 3.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add boolean dependencies between plugin and provider subpackages - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Remove workaround for maven-plugin-tools issue - Update to upstream 3.0.0-M6 milestone snapshot - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Port to TestNG 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.0.0~M4 - Update to version 3.0.0-M4. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Reuse jlink image if it already exists - Require /plans/matrix/unbound/jlink for gating - Update javapackages test plan to f42 - Add test plan for maven-unbound - Exclude maven-unbound from openjdk21 tests - Generate bindings with %jp_binding macro - Expect JVMs in %_jvmdir instead of %_jvmlibdir - Update gating.yaml - Drop bindings for OpenJDK < 21 - Update to upstream version 3.9.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Unretire package in Fedora - Update to upstream version 1.7.2 - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.0~M1 - Update to upstream version 1.8.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Unretire package in Fedora - Update to upstream version 1.7.2 - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Unretire package in Fedora - Update to upstream version 1.7.2 - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.0~M1 - Update to upstream version 1.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.5.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Obsolete removed subpackages - Bootstrap build - Non-bootstrap build - Update to version 3.4.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.4.2 - Use %autosetup -C - Update javapackages test plan to f42 - Set Java compiler source/target via javaVersion property - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.5.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Obsolete removed subpackages - Bootstrap build - Non-bootstrap build - Update to version 3.4.2. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 3.4.2 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 3.5.1 - Rebuilt for java-17-openjdk as system jdk - Use %autosetup -C - Update javapackages test plan to f42 - Set Java compiler source/target via javaVersion property - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Use %autosetup -C - Update javapackages test plan to f42 - Set Java compiler source/target via javaVersion property - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Avoid usage of libssh2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - update to 4.8.26 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - update BR - update to 4.8.25 - fix gcc-10 build failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - Use systemd-users - Resolves: rhbz#2095432 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Enable sasl pwdb (#1909724) - Update to 1.6.9 - Update to 1.6.8 - Rebuilt with libevent-2.1.12 - Update to 1.6.7 - Fix timing side-channel in SASL password database authentication (CVE-2026-47783) - Resolves: RHEL-179093 - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Resolves: https://issues.redhat.com/browse/RHEL-151404 - Resolves: https://issues.redhat.com/browse/RHEL-138704 - Fix black screen on ppc64le Resolves: https://issues.redhat.com/browse/RHEL-113831 - NV dGFX fix for firefox crashing Backport fixes for NV dGFX driver crashing firefox Resolves: https://issues.redhat.com/browse/RHEL-93219 * Update to 25.0.7 Resolves: https://issues.redhat.com/browse/RHEL-75954 - AMD Navi4x support Backport fixes for radeonsi and disable GFX12 on radv Resolves: https://issues.redhat.com/browse/RHEL-53419 - Update to 24.2.8 Resolves: https://issues.redhat.com/browse/RHEL-53868 - Update to 24.2.7 and LLVM 19 Resolves: https://issues.redhat.com/browse/RHEL-66062 - Do not build aarch64 drivers on x86 Resolves: https://issues.redhat.com/browse/RHEL-66062 - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Resolves: https://issues.redhat.com/browse/RHEL-151404 - Resolves: https://issues.redhat.com/browse/RHEL-138704 - Fix black screen on ppc64le Resolves: https://issues.redhat.com/browse/RHEL-113831 - NV dGFX fix for firefox crashing Backport fixes for NV dGFX driver crashing firefox Resolves: https://issues.redhat.com/browse/RHEL-93219 * Update to 25.0.7 Resolves: https://issues.redhat.com/browse/RHEL-75954 - AMD Navi4x support Backport fixes for radeonsi and disable GFX12 on radv Resolves: https://issues.redhat.com/browse/RHEL-53419 - Update to 24.2.8 Resolves: https://issues.redhat.com/browse/RHEL-53868 - Update to 24.2.7 and LLVM 19 Resolves: https://issues.redhat.com/browse/RHEL-66062 - Do not build aarch64 drivers on x86 Resolves: https://issues.redhat.com/browse/RHEL-66062 - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Fix s390x regressions Resolves: https://issues.redhat.com/browse/RHEL-151315 - Enable va-driver only in Fedora Resolves: https://issues.redhat.com/browse/RHEL-144489 - Resolves: https://issues.redhat.com/browse/RHEL-105157 - Resolves: https://issues.redhat.com/browse/RHEL-132415 - Disable LTO globally Resolves: https://issues.redhat.com/browse/RHEL-128255 - Resolves: https://issues.redhat.com/browse/RHEL-107477 Enable NVK also for RHEL 9 - Fix black screen on ppc64le Resolves: https://issues.redhat.com/browse/RHEL-113831 - NV dGFX fix for firefox crashing Backport fixes for NV dGFX driver crashing firefox Resolves: https://issues.redhat.com/browse/RHEL-93219 * Update to 25.0.7 Resolves: https://issues.redhat.com/browse/RHEL-75954 - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Resolves: https://redhat.atlassian.net/browse/RHEL-181885 - Fix s390x regressions Resolves: https://issues.redhat.com/browse/RHEL-151315 - Enable va-driver only in Fedora Resolves: https://issues.redhat.com/browse/RHEL-144489 - Resolves: https://issues.redhat.com/browse/RHEL-105157 - Resolves: https://issues.redhat.com/browse/RHEL-132415 - Disable LTO globally Resolves: https://issues.redhat.com/browse/RHEL-128255 - Resolves: https://issues.redhat.com/browse/RHEL-107477 Enable NVK also for RHEL 9 - Fix black screen on ppc64le Resolves: https://issues.redhat.com/browse/RHEL-113831 - NV dGFX fix for firefox crashing Backport fixes for NV dGFX driver crashing firefox Resolves: https://issues.redhat.com/browse/RHEL-93219 - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Fix s390x regressions Resolves: https://issues.redhat.com/browse/RHEL-151315 - Enable va-driver only in Fedora Resolves: https://issues.redhat.com/browse/RHEL-144489 - Resolves: https://issues.redhat.com/browse/RHEL-105157 - Resolves: https://issues.redhat.com/browse/RHEL-132415 - Disable LTO globally Resolves: https://issues.redhat.com/browse/RHEL-128255 - Resolves: https://issues.redhat.com/browse/RHEL-107477 Enable NVK also for RHEL 9 - Fix black screen on ppc64le Resolves: https://issues.redhat.com/browse/RHEL-113831 - NV dGFX fix for firefox crashing Backport fixes for NV dGFX driver crashing firefox Resolves: https://issues.redhat.com/browse/RHEL-93219 * Update to 25.0.7 Resolves: https://issues.redhat.com/browse/RHEL-75954 - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves: https://github.com/AlmaLinux/raspberry-pi/issues/32) - Resolves: https://redhat.atlassian.net/browse/RHEL-181885 - Fix s390x regressions Resolves: https://issues.redhat.com/browse/RHEL-151315 - Enable va-driver only in Fedora Resolves: https://issues.redhat.com/browse/RHEL-144489 - Resolves: https://issues.redhat.com/browse/RHEL-105157 - Resolves: https://issues.redhat.com/browse/RHEL-132415 - Disable LTO globally Resolves: https://issues.redhat.com/browse/RHEL-128255 - Resolves: https://issues.redhat.com/browse/RHEL-107477 Enable NVK also for RHEL 9 - Fix black screen on ppc64le Resolves: https://issues.redhat.com/browse/RHEL-113831 - NV dGFX fix for firefox crashing Backport fixes for NV dGFX driver crashing firefox Resolves: https://issues.redhat.com/browse/RHEL-93219 - Update Intel CPU microcode to microcode-20260512 release () - Update Intel CPU microcode to microcode-20260210 release (RHEL-151757) - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000410 to d000421 06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1 06-7e-05/80: Ice Lake-L: 00ca to 00cc 06-8c-01/80: Tiger Lake: 00bc to 00be 06-8c-02/c2: Tiger Lake: 003c to 003e 06-8d-01/c2: Tiger Lake-H: 0056 to 0058 06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661 06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421 06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661 06-97-02/07: Alder Lake: 003d to 003e 06-97-05/07: Alder Lake: 003d to 003e 06-9a-03/80: Alder Lake-L: 043a to 043b 06-9a-04/80: Alder Lake-L: 043a to 043b 06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c 06-9a-04/80: Alder Lake-L: 043a to 043b 06-a7-01/02: Rocket Lake: 0064 to 0065 06-aa-04/e6: Meteor Lake-L: 0025 to 0028 06-ad-01/20: Granite Rapids-X: a000124 to a000133 06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405 06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3 06-b5-00/80: Arrow Lake-U: 000a to 000d 06-b7-01/32: Raptor Lake: 0132 to 0133 06-ba-02/e0: Raptor Lake-P: 6133 to 6134 06-ba-03/e0: Raptor Lake-P: 6133 to 6134 06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021 06-bf-02/07: Raptor Lake-S: 003d to 003e 06-bf-05/07: Raptor Lake-S: 003d to 003e 06-c5-02/82: Arrow Lake-H: 011a to 011b 06-c6-02/82: Arrow Lake: 011a to 011b 06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3 Resolves: RHEL-151757 - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config - Update Intel CPU microcode to microcode-20251111 release (RHEL-128199) - New microcode files (in hex): 06-ae-01: Granite Rapids-D: revision 1000273 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650 06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410 06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650 06-97-02/07: Alder Lake: 003a to 003d 06-97-05/07: Alder Lake: 003a to 003d 06-9a-03/80: Alder Lake-L: 0437 to 043a 06-9a-04/80: Alder Lake-L: 0437 to 043a 06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b 06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0 06-ad-01/20: Granite Rapids-X: a000100 to a000124 06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382 06-b7-01/32: Raptor Lake: 012f to 0132 06-ba-02/e0: Raptor Lake-P: 4129 to 6133 06-ba-03/e0: Raptor Lake-P: 4129 to 6133 06-bd-01/80: Lunar Lake: 0123 to 0125 06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e 06-bf-02/07: Raptor Lake-S: 003a to 003d 06-bf-05/07: Raptor Lake-S: 003a to 003d 06-c5-02/82: Arrow Lake-H: 0119 to 011a 06-c6-02/82: Arrow Lake: 0119 to 011a 06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0 - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147: "REP SCASB, REP CMPSB may return incorrect results when racing memory access with another core or thread" on Raptor Lake, Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids. - Update Intel CPU microcode to microcode-20250812 release - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404 up to 0xd000410; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0 up to 0x10002e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24 up to 0x25; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa0000d1 up to 0xa000100; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003a2 up to 0x10003d0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341 up to 0x3000362; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up to 0x123; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9 up to 0x210002b3. - Add a caveat to provide ability to persistently disable SPR-EE updates beyond 0x2b0005c0 on systems where absence of latency spikes is more important than lack of the latest CVE mitigations. - Update Intel CPU microcode to microcode-20250512 release, addresses CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420, CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012 (RHEL-94294, RHEL-91231, RHEL-91224, RHEL-91224, RHEL-91239) - Addition of 06-8f-04/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-06/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision 0xa0000d1; - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision 0x10003a2; - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa; - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfc up to 0x100; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up to 0x104; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003707 up to 0x5003901; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904 up to 0x7002b01; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5 up to 0xd000404; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0 up to 0x10002d0; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up to 0x26; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6 up to 0xca; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up to 0x3c; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up to 0x56; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x436 up to 0x437; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x436 up to 0x437; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x436 up to 0x437; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up to 0xa; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436 up to 0x437; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc up to 0x100; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe up to 0x102; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfc up to 0x100; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up to 0x64; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20 up to 0x24; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330 up to 0x3000341; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up to 0x12f; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12c up to 0x12f; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up to 0x1d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291 up to 0x210002a9. - Update Intel CPU microcode to microcode-20250211 release, addresses CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047, CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157, CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79182, RHEL-79186, RHEL-79187, RHEL-79242, RHEL-79243, RHEL-79246, RHEL-79251, RHEL-79252): - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330; - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at revision 0x12c; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf8 up to 0xfa; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x100 up to 0x102; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7 up to 0xd0003f5; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0 up to 0x10002c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x435 up to 0x436; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x435 up to 0x436; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up to 0x9; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435 up to 0x436; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up to 0x63; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up to 0x12c; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode from revision 0x4123 up to 0x4124; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up to 0x1c; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283 up to 0x21000291. - Update Intel CPU microcode to microcode-20241112 release, addresses CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67336): - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x434 up to 0x435; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434 up to 0x435; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f up to 0x20; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up to 0x12b; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230 up to 0x21000283. - Update Intel CPU microcode to microcode-20240910 release, addresses CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-58057): - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb6 up to 0xb8; - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf4 up to 0xf6; - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf4 up to 0xf6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfa up to 0xfc; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf6 up to 0xf8; - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf6 up to 0xf8; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xfc up to 0x100; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003605 up to 0x5003707; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802 up to 0x7002904; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1 up to 0xd0003e7; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290 up to 0x10002b0; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4 up to 0xc6; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up to 0x38; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up to 0x52; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up to 0x1a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x433 up to 0x434; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433 up to 0x434; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa up to 0xfc; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa up to 0xfe; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfa up to 0xfc; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up to 0x62; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c up to 0x1f; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up to 0x129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up to 0x1a (old pf 0x11). - Update Intel CPU microcode to microcode-20260812 release (RHEL-240771) - Security advisories: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html CVE-2025-31936 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01404.html CVE-2025-31938 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01423.html CVE-2026-20917 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html CVE-2025-35973 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01435.html CVE-2026-20716 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01441.html CVE-2026-20760 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html CVE-2026-20713, CVE-2026-20901 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01443.html CVE-2026-20707 - New microcode files (in hex): 06-b7-04: Raptor Lake: revision 0137 06-cc-02: Panther Lake: revision 011c 06-cc-03: Panther Lake: revision 011c 06-d5-01: Wildcat Lake: revision 000c 06-d7-00: Bartlett Lake: revision 0137 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000421 to d000433 06-6c-01/10: Ice Lake-D: 10002f1 to 1000301 06-7e-05/80: Ice Lake-L: 00cc to 00ce 06-8f-07/87: Sapphire Rapids: 2b000661 to 2b000685 06-8f-08/10: Sapphire Rapids with HBM: 2c000421 to 2c000435 06-8f-08/87: Sapphire Rapids: 2b000661 to 2b000685 06-a7-01/02: Rocket Lake: 0065 to 0066 06-ad-01/20: Granite Rapids-X: a000133 to a000151 06-ad-01/95: Granite Rapids-X: 1000405 to 1000434 06-ae-01/97: Granite Rapids-D: 10002f3 to 1000309 06-af-03/01: Crestmont (Sierra Forest): 3000382 to 30003b2 06-b5-00/80: Arrow Lake-U: 000d to 000e 06-b7-01/36: Raptor Lake: 0133 to 0137, platform bit 04 added 06-bd-01/80: Lunar Lake: 0125 to 0128 06-c5-02/82: Arrow Lake-H: 011b to 0122 06-c6-02/82: Arrow Lake: 011b to 0122 06-cf-02/87: Emerald Rapids: 210002d3 to 210002f4 - Update Intel CPU microcode to microcode-20260210 release (RHEL-151757) - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000410 to d000421 06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1 06-7e-05/80: Ice Lake-L: 00ca to 00cc 06-8c-01/80: Tiger Lake: 00bc to 00be 06-8c-02/c2: Tiger Lake: 003c to 003e 06-8d-01/c2: Tiger Lake-H: 0056 to 0058 06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661 06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421 06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661 06-97-02/07: Alder Lake: 003d to 003e 06-97-05/07: Alder Lake: 003d to 003e 06-9a-03/80: Alder Lake-L: 043a to 043b 06-9a-04/80: Alder Lake-L: 043a to 043b 06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c 06-9a-04/80: Alder Lake-L: 043a to 043b 06-a7-01/02: Rocket Lake: 0064 to 0065 06-aa-04/e6: Meteor Lake-L: 0025 to 0028 06-ad-01/20: Granite Rapids-X: a000124 to a000133 06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405 06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3 06-b5-00/80: Arrow Lake-U: 000a to 000d 06-b7-01/32: Raptor Lake: 0132 to 0133 06-ba-02/e0: Raptor Lake-P: 6133 to 6134 06-ba-03/e0: Raptor Lake-P: 6133 to 6134 06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021 06-bf-02/07: Raptor Lake-S: 003d to 003e 06-bf-05/07: Raptor Lake-S: 003d to 003e 06-c5-02/82: Arrow Lake-H: 011a to 011b 06-c6-02/82: Arrow Lake: 011a to 011b 06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3 Resolves: RHEL-151757 - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config - Update Intel CPU microcode to microcode-20251111 release (RHEL-128199) - New microcode files (in hex): 06-ae-01: Granite Rapids-D: revision 1000273 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650 06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410 06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650 06-97-02/07: Alder Lake: 003a to 003d 06-97-05/07: Alder Lake: 003a to 003d 06-9a-03/80: Alder Lake-L: 0437 to 043a 06-9a-04/80: Alder Lake-L: 0437 to 043a 06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b 06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0 06-ad-01/20: Granite Rapids-X: a000100 to a000124 06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382 06-b7-01/32: Raptor Lake: 012f to 0132 06-ba-02/e0: Raptor Lake-P: 4129 to 6133 06-ba-03/e0: Raptor Lake-P: 4129 to 6133 06-bd-01/80: Lunar Lake: 0123 to 0125 06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e 06-bf-02/07: Raptor Lake-S: 003a to 003d 06-bf-05/07: Raptor Lake-S: 003a to 003d 06-c5-02/82: Arrow Lake-H: 0119 to 011a 06-c6-02/82: Arrow Lake: 0119 to 011a 06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0 - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147: "REP SCASB, REP CMPSB may return incorrect results when racing memory access with another core or thread" on Raptor Lake, Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids. - Update Intel CPU microcode to microcode-20250812 release - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404 up to 0xd000410; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0 up to 0x10002e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24 up to 0x25; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa0000d1 up to 0xa000100; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003a2 up to 0x10003d0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341 up to 0x3000362; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up to 0x123; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9 up to 0x210002b3. - Add a caveat to provide ability to persistently disable SPR-EE updates beyond 0x2b0005c0 on systems where absence of latency spikes is more important than lack of the latest CVE mitigations. - Update Intel CPU microcode to microcode-20250512 release, addresses CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420, CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012 (RHEL-94294, RHEL-91231, RHEL-91224, RHEL-91224, RHEL-91239) - Addition of 06-8f-04/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-06/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision 0xa0000d1; - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision 0x10003a2; - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa; - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfc up to 0x100; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up to 0x104; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003707 up to 0x5003901; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904 up to 0x7002b01; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5 up to 0xd000404; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0 up to 0x10002d0; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up to 0x26; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6 up to 0xca; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up to 0x3c; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up to 0x56; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x436 up to 0x437; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x436 up to 0x437; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x436 up to 0x437; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up to 0xa; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436 up to 0x437; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc up to 0x100; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe up to 0x102; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfc up to 0x100; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up to 0x64; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20 up to 0x24; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330 up to 0x3000341; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up to 0x12f; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12c up to 0x12f; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up to 0x1d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291 up to 0x210002a9. - Update Intel CPU microcode to microcode-20250211 release, addresses CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047, CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157, CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79182, RHEL-79186, RHEL-79187, RHEL-79242, RHEL-79243, RHEL-79246, RHEL-79251, RHEL-79252): - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330; - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at revision 0x12c; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf8 up to 0xfa; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x100 up to 0x102; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7 up to 0xd0003f5; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0 up to 0x10002c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x435 up to 0x436; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x435 up to 0x436; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up to 0x9; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435 up to 0x436; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up to 0x63; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up to 0x12c; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode from revision 0x4123 up to 0x4124; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up to 0x1c; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283 up to 0x21000291. - Update Intel CPU microcode to microcode-20241112 release, addresses CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67336): - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x434 up to 0x435; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434 up to 0x435; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f up to 0x20; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up to 0x12b; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230 up to 0x21000283. - Update Intel CPU microcode to microcode-20240910 release, addresses CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-58057): - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb6 up to 0xb8; - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf4 up to 0xf6; - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf4 up to 0xf6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfa up to 0xfc; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf6 up to 0xf8; - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf6 up to 0xf8; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xfc up to 0x100; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003605 up to 0x5003707; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802 up to 0x7002904; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1 up to 0xd0003e7; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290 up to 0x10002b0; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4 up to 0xc6; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up to 0x38; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up to 0x52; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up to 0x1a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x433 up to 0x434; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433 up to 0x434; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa up to 0xfc; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa up to 0xfe; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfa up to 0xfc; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up to 0x62; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c up to 0x1f; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up to 0x129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up to 0x1a (old pf 0x11). - Update Intel CPU microcode to microcode-20260210 release (RHEL-151757) - Microcode files (/platform_mask shown) with revision updates (in hex): 06-6a-06/87: Ice Lake-X: d000410 to d000421 06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1 06-7e-05/80: Ice Lake-L: 00ca to 00cc 06-8c-01/80: Tiger Lake: 00bc to 00be 06-8c-02/c2: Tiger Lake: 003c to 003e 06-8d-01/c2: Tiger Lake-H: 0056 to 0058 06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661 06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421 06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661 06-97-02/07: Alder Lake: 003d to 003e 06-97-05/07: Alder Lake: 003d to 003e 06-9a-03/80: Alder Lake-L: 043a to 043b 06-9a-04/80: Alder Lake-L: 043a to 043b 06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c 06-9a-04/80: Alder Lake-L: 043a to 043b 06-a7-01/02: Rocket Lake: 0064 to 0065 06-aa-04/e6: Meteor Lake-L: 0025 to 0028 06-ad-01/20: Granite Rapids-X: a000124 to a000133 06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405 06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3 06-b5-00/80: Arrow Lake-U: 000a to 000d 06-b7-01/32: Raptor Lake: 0132 to 0133 06-ba-02/e0: Raptor Lake-P: 6133 to 6134 06-ba-03/e0: Raptor Lake-P: 6133 to 6134 06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021 06-bf-02/07: Raptor Lake-S: 003d to 003e 06-bf-05/07: Raptor Lake-S: 003d to 003e 06-c5-02/82: Arrow Lake-H: 011a to 011b 06-c6-02/82: Arrow Lake: 011a to 011b 06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3 Resolves: RHEL-151757 - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config - Update Intel CPU microcode to microcode-20251111 release (RHEL-128199) - New microcode files (in hex): 06-ae-01: Granite Rapids-D: revision 1000273 - Microcode files (/platform_mask shown) with revision updates (in hex): 06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650 06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410 06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650 06-97-02/07: Alder Lake: 003a to 003d 06-97-05/07: Alder Lake: 003a to 003d 06-9a-03/80: Alder Lake-L: 0437 to 043a 06-9a-04/80: Alder Lake-L: 0437 to 043a 06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b 06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0 06-ad-01/20: Granite Rapids-X: a000100 to a000124 06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382 06-b7-01/32: Raptor Lake: 012f to 0132 06-ba-02/e0: Raptor Lake-P: 4129 to 6133 06-ba-03/e0: Raptor Lake-P: 4129 to 6133 06-bd-01/80: Lunar Lake: 0123 to 0125 06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e 06-bf-02/07: Raptor Lake-S: 003a to 003d 06-bf-05/07: Raptor Lake-S: 003a to 003d 06-c5-02/82: Arrow Lake-H: 0119 to 011a 06-c6-02/82: Arrow Lake: 0119 to 011a 06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0 - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147: "REP SCASB, REP CMPSB may return incorrect results when racing memory access with another core or thread" on Raptor Lake, Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids. - Update Intel CPU microcode to microcode-20250812 release - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404 up to 0xd000410; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0 up to 0x10002e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c0003f7 up to 0x2c000401; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000639 up to 0x2b000643; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24 up to 0x25; - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision 0xa0000d1 up to 0xa000100; - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision 0x10003a2 up to 0x10003d0; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341 up to 0x3000362; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128 up to 0x4129; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129; - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up to 0x123; - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from revision 0x118 up to 0x119; - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision 0x118 up to 0x119; - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from revision 0x118 up to 0x119; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9 up to 0x210002b3. - Add a caveat to provide ability to persistently disable SPR-EE updates beyond 0x2b0005c0 on systems where absence of latency spikes is more important than lack of the latest CVE mitigations. - Update Intel CPU microcode to microcode-20250512 release, addresses CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420, CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012 (RHEL-94294, RHEL-91231, RHEL-91224, RHEL-91224, RHEL-91239) - Addition of 06-8f-04/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-06/0x10 microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7; - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639; - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision 0xa0000d1; - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision 0x10003a2; - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa; - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at revision 0x118; - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision 0x118; - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at revision 0x118; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfc up to 0x100; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up to 0x104; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003707 up to 0x5003901; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904 up to 0x7002b01; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5 up to 0xd000404; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0 up to 0x10002d0; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up to 0x26; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6 up to 0xca; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up to 0x3c; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up to 0x56; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000620 up to 0x2b000639; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from revision 0x38 up to 0x3a; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x436 up to 0x437; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x436 up to 0x437; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x436 up to 0x437; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up to 0xa; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436 up to 0x437; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc up to 0x100; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc up to 0x100; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe up to 0x102; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfc up to 0x100; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up to 0x64; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20 up to 0x24; - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330 up to 0x3000341; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up to 0x12f; - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from revision 0x12c up to 0x12f; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128; - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up to 0x1d; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from revision 0x38 up to 0x3a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up to 0x3a; - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from revision 0x38 up to 0x3a; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291 up to 0x210002a9. - Update Intel CPU microcode to microcode-20250211 release, addresses CVE-2023-34440, CVE-2023-43758, CVE-2024-24582, CVE-2024-28047, CVE-2024-28127, CVE-2024-29214, CVE-2024-31068, CVE-2024-31157, CVE-2024-37020, CVE-2024-39279, CVE-2024-39355, CVE-2024-36293 (RHEL-79182, RHEL-79186, RHEL-79187, RHEL-79242, RHEL-79243, RHEL-79246, RHEL-79251, RHEL-79252): - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) at revision 0x38; - Addition of 06-af-03/0x01 (SRF-SP C0) microcode at revision 0x3000330; - Addition of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) at revision 0x12c; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) at revision 0x38; - Addition of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Addition of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) at revision 0x38; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf8 up to 0xfa; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x100 up to 0x102; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003e7 up to 0xd0003f5; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002b0 up to 0x10002c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b000603 up to 0x2b000620; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000390 up to 0x2c0003e0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b000603 up to 0x2b000620; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x37 up to 0x38; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x435 up to 0x436; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x435 up to 0x436; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x435 up to 0x436; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x7 up to 0x9; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x435 up to 0x436; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x62 up to 0x63; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12b up to 0x12c; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4123 up to 0x4124; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4123 up to 0x4124; - Update of 06-ba-08/0xe0 microcode from revision 0x4123 up to 0x4124; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1a up to 0x1c; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x37 up to 0x38; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x37 up to 0x38; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x37 up to 0x38; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000283 up to 0x21000291; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000283 up to 0x21000291. - Update Intel CPU microcode to microcode-20241112 release, addresses CVE-2024-21820, CVE-2024-21853, CVE-2024-23918, CVE-2024-23984 (RHEL-67336): - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0005c0 up to 0x2b000603; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x36 up to 0x37; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x434 up to 0x435; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x434 up to 0x435; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x434 up to 0x435; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1f up to 0x20; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x129 up to 0x12b; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4122 up to 0x4123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4122 up to 0x4123; - Update of 06-ba-08/0xe0 microcode from revision 0x4122 up to 0x4123; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x36 up to 0x37; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x36 up to 0x37; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x36 up to 0x37; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) from revision 0x21000230 up to 0x21000283; - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000230 up to 0x21000283. - Update Intel CPU microcode to microcode-20240910 release, addresses CVE-2024-23984, CVE-2024-24853, CVE-2024-24968, CVE-2024-24980, CVE-2024-25939 (RHEL-58057): - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb6 up to 0xb8; - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xf4 up to 0xf6; - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xf4 up to 0xf6; - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xf4 up to 0xf6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xfa up to 0xfc; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf6 up to 0xf8; - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf6 up to 0xf8; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xfc up to 0x100; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003605 up to 0x5003707; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002802 up to 0x7002904; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003d1 up to 0xd0003e7; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000290 up to 0x10002b0; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc4 up to 0xc6; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x36 up to 0x38; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x50 up to 0x52; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x19 up to 0x1a; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x35 up to 0x36; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x433 up to 0x434; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x433 up to 0x434; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x433 up to 0x434; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfa up to 0xfc; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfa up to 0xfc; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfa up to 0xfe; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xfa up to 0xfc; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5e up to 0x62; - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x1c up to 0x1f; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x123 up to 0x129; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from revision 0x4121 up to 0x4122; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) from revision 0x4121 up to 0x4122; - Update of 06-ba-08/0xe0 microcode from revision 0x4121 up to 0x4122; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x35 up to 0x36; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x35 up to 0x36; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x35 up to 0x36; - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x17 up to 0x1a (old pf 0x11). - Update Intel CPU microcode to microcode-20240531 release, addresses CVE-2023-22655, CVE-2023-23583. CVE-2023-28746, CVE-2023-38575, CVE-2023-39368, CVE-2023-42667, CVE-2023-43490, CVE-2023-45733, CVE-2023-46103, CVE-2023-49141 (RHEL-30861, RHEL-30864, RHEL-30867, RHEL-30870, RHEL-30873, RHEL-41094, RHEL-41109): - Addition of 06-aa-04/0xe6 (MTL-H/U C0) microcode at revision 0x1c; - Addition of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) at revision 0x4121; - Addition of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) at revision 0x4121; - Addition of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-08) at revision 0x4121; - Addition of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-08) at revision 0x4121; - Addition of 06-ba-08/0xe0 microcode at revision 0x4121; - Addition of 06-cf-01/0x87 (EMR-SP A0) microcode at revision 0x21000230; - Addition of 06-cf-02/0x87 (EMR-SP A1) microcode (in intel-ucode/06-cf-01) at revision 0x21000230; - Addition of 06-cf-01/0x87 (EMR-SP A0) microcode (in intel-ucode/06-cf-02) at revision 0x21000230; - Addition of 06-cf-02/0x87 (EMR-SP A1) microcode at revision 0x21000230; - Removal of 06-8f-04/0x10 microcode at revision 0x2c000290; - Removal of 06-8f-04/0x87 (SPR-SP E0/S1) microcode at revision 0x2b0004d0; - Removal of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-04) at revision 0x2c000290; - Removal of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-04) at revision 0x2b0004d0; - Removal of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-04) at revision 0x2c000290; - Removal of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-04) at revision 0x2b0004d0; - Removal of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-04) at revision 0x2b0004d0; - Removal of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-04) at revision 0x2c000290; - Removal of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-04) at revision 0x2b0004d0; - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb4 up to 0xb6; - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from revision 0xf8 up to 0xfa; - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xf4 up to 0xf8; - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xf4 up to 0xf6; - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xf4 up to 0xf6; - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xfa up to 0xfc; - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000181 up to 0x1000191; - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003604 up to 0x4003605; - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision 0x5003604 up to 0x5003605; - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002703 up to 0x7002802; - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision 0xe000014 up to 0xe000015; - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x38 up to 0x3e; - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003b9 up to 0xd0003d1; - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x1000268 up to 0x1000290; - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x3e up to 0x42; - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x22 up to 0x24; - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc2 up to 0xc4; - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x34 up to 0x36; - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x4e up to 0x50; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-05) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-05) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-06) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-06/0x10 microcode from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in intel-ucode/06-8f-06) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-06) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in intel-ucode/06-8f-07) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in intel-ucode/06-8f-08) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in intel-ucode/06-8f-08) from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision 0x2c000290 up to 0x2c000390; - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision 0x2b0004d0 up to 0x2b0005c0; - Update of 06-96-01/0x01 (EHL B1) microcode from revision 0x17 up to 0x19; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision 0x32 up to 0x35; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-97-02) from revision 0x32 up to 0x35; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x32 up to 0x35; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02) from revision 0x32 up to 0x35; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-97-05) from revision 0x32 up to 0x35; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x32 up to 0x35; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x32 up to 0x35; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05) from revision 0x32 up to 0x35; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision 0x430 up to 0x433; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in intel-ucode/06-9a-03) from revision 0x430 up to 0x433; - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in intel-ucode/06-9a-04) from revision 0x430 up to 0x433; - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x430 up to 0x433; - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x5 up to 0x7; - Update of 06-9c-00/0x01 (JSL A0/A1) microcode from revision 0x24000024 up to 0x24000026; - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xf8 up to 0xfa; - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xf8 up to 0xfa; - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xf8 up to 0xfa; - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xf8 up to 0xfa; - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision 0xf8 up to 0xfa; - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x5d up to 0x5e; - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x11d up to 0x123; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision 0x411c up to 0x4121; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in intel-ucode/06-ba-02) from revision 0x411c up to 0x4121; - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in intel-ucode/06-ba-03) from revision 0x411c up to 0x4121; - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x411c up to 0x4121; - Update of 06-be-00/0x11 (ADL-N A0) microcode from revision 0x12 up to 0x17; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-02) from revision 0x32 up to 0x35; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-02) from revision 0x32 up to 0x35; - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x32 up to 0x35; - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02) from revision 0x32 up to 0x35; - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in intel-ucode/06-bf-05) from revision 0x32 up to 0x35; - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in intel-ucode/06-bf-05) from revision 0x32 up to 0x35; - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05) from revision 0x32 up to 0x35; - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x32 up to 0x35. - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 12.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Update license to SPDX format - Resolves: RHEL-1045 - Update to 11.0.0 - Fix build on riscv64. - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Resolves: RHEL-131012 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string() - Resolves: RHEL-67088 - CVE-2024-52533 mingw-glib2: buffer overflow in set_connect_msg() - Bump glib2 version 2.78.6 - Fix CVEs: CVE-2024-34397 - Resolves: RHEL-35776 - Resolves: RHEL-131012 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string() - Resolves: RHEL-67088 - CVE-2024-52533 mingw-glib2: buffer overflow in set_connect_msg() - Bump glib2 version 2.78.6 - Fix CVEs: CVE-2024-34397 - Resolves: RHEL-35776 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 3.4.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1055 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.4.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 3.4.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1055 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.4.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1058 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update license to SPDX format - Resolves: RHEL-1058 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 10.42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to 10.40 - Rebuild with mingw-gcc-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 10.39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 10.42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to 10.40 - Rebuild with mingw-gcc-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 10.39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump pixman version 0.42.2 - Drop DesktopQE gating - Fix CVEs: CVE-2022-44638 - Resolves: RHEL-5013 - Bump pixman version 0.42.2 - Drop DesktopQE gating - Fix CVEs: CVE-2022-44638 - Resolves: RHEL-5013 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Move to real version numbers upstream. - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to 20210127. - Add pnp_wait.exe binary. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1059 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update license to SPDX format - Resolves: RHEL-1059 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Build UCRT64 package - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Build UCRT64 package - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Resolves: RHEL-131012 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string() - Resolves: RHEL-67088 - CVE-2024-52533 mingw-glib2: buffer overflow in set_connect_msg() - Bump glib2 version 2.78.6 - Fix CVEs: CVE-2024-34397 - Resolves: RHEL-35776 - Resolves: RHEL-131012 - CVE-2025-13601 mingw-glib2: Integer overflow in in g_escape_uri_string() - Resolves: RHEL-67088 - CVE-2024-52533 mingw-glib2: buffer overflow in set_connect_msg() - Bump glib2 version 2.78.6 - Fix CVEs: CVE-2024-34397 - Resolves: RHEL-35776 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 3.4.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1055 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.4.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 3.4.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1055 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.4.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Resolves: RHEL-1058 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update license to SPDX format - Resolves: RHEL-1058 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 10.42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to 10.40 - Rebuild with mingw-gcc-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 10.39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 10.42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to 10.40 - Rebuild with mingw-gcc-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to 10.39 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bump pixman version 0.42.2 - Drop DesktopQE gating - Fix CVEs: CVE-2022-44638 - Resolves: RHEL-5013 - Bump pixman version 0.42.2 - Drop DesktopQE gating - Fix CVEs: CVE-2022-44638 - Resolves: RHEL-5013 - Update license to SPDX format - Resolves: RHEL-1059 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update license to SPDX format - Resolves: RHEL-1059 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Build UCRT64 package - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Build UCRT64 package - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Fix the Crash in zlib deflateBound() function on s390x - Resolves: BZ#2193044 - Fix covscan issue CWE-681 - Resolve fuzzing issue for unknown memory access - Rebased Power 8 optimization patches - Fix for Unnecessary IFUNC resolver for crc32_z - Fix for python3.11 broken libxml2 and lxml on s390x - Inflate small window optimization for IBM z15 rhbz#2154775 - Fix for IBM strm.adler rhbz#2134074 - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c - Resolves: CVE-2022-37434 - Fix CVE-2018-25032 Resolves: CVE-2018-25032 - Fix for IBM compressBound() rhbz#2056899 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix the Crash in zlib deflateBound() function on s390x - Resolves: BZ#2193044 - Fix covscan issue CWE-681 - Resolve fuzzing issue for unknown memory access - Rebased Power 8 optimization patches - Fix for Unnecessary IFUNC resolver for crc32_z - Fix for python3.11 broken libxml2 and lxml on s390x - Inflate small window optimization for IBM z15 rhbz#2154775 - Fix for IBM strm.adler rhbz#2134074 - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c - Resolves: CVE-2022-37434 - Fix CVE-2018-25032 Resolves: CVE-2018-25032 - Fix for IBM compressBound() rhbz#2056899 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to 1.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.0.1 - Switch to the meson build system - Update to 1.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to 1.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.0.1 - Switch to the meson build system - Update to 1.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Set javac compiler release to Java 8 - Rebuilt for java-17-openjdk as system jdk - Don't build mockito-junit-jupiter in bootstrap mode - Version 3.12.4 - Add inline and junit-jupiter subpackages - Drop OpenJDK 17 workarounds - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Workaround build issue with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.7.13 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.8.0 - Update to upstream version 5.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Set javac compiler release to Java 8 - Rebuilt for java-17-openjdk as system jdk - Don't build mockito-junit-jupiter in bootstrap mode - Version 3.12.4 - Add inline and junit-jupiter subpackages - Drop OpenJDK 17 workarounds - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Workaround build issue with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.7.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Set javac compiler release to Java 8 - Rebuilt for java-17-openjdk as system jdk - Don't build mockito-junit-jupiter in bootstrap mode - Version 3.12.4 - Add inline and junit-jupiter subpackages - Drop OpenJDK 17 workarounds - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Workaround build issue with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.7.13 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to upstream version 3.7.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 3.5.13 - Update to ustream version 3.5.13 - Update to version 3.5.5 - Update to version 2.28.2 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.8.0 - Update to upstream version 5.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Set javac compiler release to Java 8 - Rebuilt for java-17-openjdk as system jdk - Don't build mockito-junit-jupiter in bootstrap mode - Version 3.12.4 - Add inline and junit-jupiter subpackages - Drop OpenJDK 17 workarounds - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Workaround build issue with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 3.7.13 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.8.0 - Update to upstream version 5.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 1.11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.0.0 - Remove dependency on Jsoup - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Fix for Sisu 0.9.0.M3 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to version 1.11. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.0.0 - Remove dependency on Jsoup - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Drop explicit requires on javapackages-tools - Fix for Sisu 0.9.0.M3 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Rebuild - Initial build - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Rebuild - Initial build - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.11 - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Implement bootstrap mode - Initial build - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.11 - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Implement bootstrap mode - Initial build - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 67 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 60. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 60 - Update to upstream version 50 - Update javapackages test plan to f42 - Update to upstream version 85 - Resolves: rhbz#2304212 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 84 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 78 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 77 - Add support for _NET_WORKAREA and _GTK_WORKAREAS Resolves: RHEL-100836 - Fix a memory leak with UTF-8 strings Resolves: RHEL-100816 - Keep drop-down menus on the same monitor as the pull-down button with Xinerama Resolves: RHEL-92832 - Add Xinerama support (RHEL-69956) - Fix CVE-2023-43788: out of bounds read in XpmCreateXpmImageFromBuffer() - Fix CVE-2023-43789: out of bounds read on XPM with corrupted colormap - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - add /usr/share/doc/mpfr ownership to the doc subpackage as well (RHEL-36690) - add /usr/share/doc/mpfr ownership (RHEL-36690) - fix use of uninitialized value in sin_cos (RHEL-35392) - workaround for uAPI header build issue - fix mptcpize to work also when protocol number is 0 (upstream issue #159) and when command resides in another file system (upstream issue #161) Related: rhbz#2015623 - update to version 0.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - add a simple sanity test and enable gating. Related: rhbz#1962741 - don't overwrite global build options. Related: rhbz#1967697 - fix 'check_conflicts' on multilib. Related: rhbz#1967697 - update to version 0.7 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - update to version 0.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - initial build - add Java 17 support patch from Mamoru Tasaka (rhbz#2182696) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gettext-0.21-covscan.patch to fix issues detected by static analyzers Add gettext-0.21-disable-libtextstyle.patch Do not build libtextstyle, as it depends on libcroco which is now unmaintained and has known security bugs. Obsolete libtextstyle and libtextstyle-devel packages. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add gating and fix gating errors. rhbz#2047292 - Fix FTBFS. rhbz#2046759 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix FTBFS. rhbz#1987721 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix FTBFS. rhbz#1943037 - Fix enablement of wxi tests - Use perl-base and gettext for more minimal dep chain - new version v0.101 - Fix FTBFS. rhbz#1923683 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix FTBFS. rhbz#1864178 - Drop mingw-gstreamer* checks, it's outdated. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Sanity check input on workspace activation API Related: RHEL-68825 - Backport linux-dmabuf v4 support to restore hardware acceleration in Xwayland 24.1 with Mesa 25.2 Resolves: RHEL-129832 - Fix handling of more WM_HINTS window icon types Resolves: RHEL-70872 - Fix input latency regression Resolves: RHEL-117098 - Backport fix for screen not refreshing properly Resolves: RHEL-89352 - Backport fixes for cogl OpenGL conformance Resolves: RHEL-4521 - Fix polyinstantiation preventing Xwayland to start Resolves: RHEL-90588 - Do not disable touchscreen on DPMS off if touch-mode is disabled Resolves: RHEL-31742 - Fix stuck modifier keys Resolves: RHEL-21286 - Backport fix for flicker-free login Resolves: RHEL-10895 - Don't unminimize mapped windows Resolves: RHEL-180797 - Sanity check input on workspace activation API Related: RHEL-68825 - Backport linux-dmabuf v4 support to restore hardware acceleration in Xwayland 24.1 with Mesa 25.2 Resolves: RHEL-129832 - Fix handling of more WM_HINTS window icon types Resolves: RHEL-70872 - Fix input latency regression Resolves: RHEL-117098 - Backport fix for screen not refreshing properly Resolves: RHEL-89352 - Backport fixes for cogl OpenGL conformance Resolves: RHEL-4521 - Fix polyinstantiation preventing Xwayland to start Resolves: RHEL-90588 - Do not disable touchscreen on DPMS off if touch-mode is disabled Resolves: RHEL-31742 - Fix stuck modifier keys Resolves: RHEL-21286 - Switch stylus button order to match Xorg session Related: RHEL-190440 - Don't unminimize mapped windows Resolves: RHEL-180797 - Sanity check input on workspace activation API Related: RHEL-68825 - Backport linux-dmabuf v4 support to restore hardware acceleration in Xwayland 24.1 with Mesa 25.2 Resolves: RHEL-129832 - Fix handling of more WM_HINTS window icon types Resolves: RHEL-70872 - Fix input latency regression Resolves: RHEL-117098 - Backport fix for screen not refreshing properly Resolves: RHEL-89352 - Backport fixes for cogl OpenGL conformance Resolves: RHEL-4521 - Fix polyinstantiation preventing Xwayland to start Resolves: RHEL-90588 - Do not disable touchscreen on DPMS off if touch-mode is disabled Resolves: RHEL-31742 - add gating.yaml file - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 1.3.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Default to building without documentation for RHEL. (#1933222) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Patch to workaround renamed SourceSans font family - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 2.15.03 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - server: Fix .zero fallback path resolves: RHEL-101635 - Add support for VDDK 9.0.0.0 resolves: RHEL-99466 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95814 - vddk: Improve statistics related: RHEL-94823 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95363 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94823 - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85510 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89353 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71694 - Rebase to 1.38.5 (along stable branch) - Rebase to 1.38.3 (along stable branch) - Send the last error to the NBD client resolves: RHEL-50664 - server: Fix .zero fallback path resolves: RHEL-101635 - Add support for VDDK 9.0.0.0 resolves: RHEL-99466 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95814 - vddk: Improve statistics related: RHEL-94823 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95363 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94823 - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85510 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89353 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71694 - Rebase to 1.38.5 (along stable branch) - Rebase to 1.38.3 (along stable branch) - Send the last error to the NBD client resolves: RHEL-50664 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - remove execute permissions from ANNOUNCE file (RHEL-101067) - guard against corrupt terminfo data in string conversion (CVE-2022-29458 RHEL-100135) - ignore TERMINFO and HOME only if setuid/setgid/capability (#2211666) - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491) - ignore TERMINFO and HOME environment variables if running as root (#2211666) - remove execute permissions from ANNOUNCE file (RHEL-101067) - guard against corrupt terminfo data in string conversion (CVE-2022-29458 RHEL-100135) - ignore TERMINFO and HOME only if setuid/setgid/capability (#2211666) - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491) - ignore TERMINFO and HOME environment variables if running as root (#2211666) - fix creation of /var/lib/net-snmp in image mode (RHEL-132655) - fix out of bound access issue (RHEL-137511) - enable PQC (RHEL-132653) - remove wrong assert (RHEL-122095) - fix inverted usage of -n in snmptrapd (RHEL-101078) - fix use after free issue (RHEL-121091) - fix help and manpage for net-snmp-create-v3-user script(RHEL-101614 and RHEL-103557) - fix segfault with error on subcontainer (RHEL-46033) - fix unexpected header length in /proc/net/snmp (RHEL-44357) - fix changelog issue - fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808, CVE-2022-24809 and CVE-2022-24810 (RHEL-26649) - version bump - version bump - version bump - netconsole: var/lock -> run/lock - netconsole: source sysconfig/network only if it exists - netconsole: remove unused variables - netconsole: remove trailing whitespaces - sync spec with c9s - rename_device: free path after it is used - rename_device: remove trailing whitespaces - Add -r to while read as per shellcheck - Fix splitting spaces in paths from statetab files - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New version Resolves: rhbz#1912617 - Added workaround for Windows Server 2019 Resolves: rhbz#1867047 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Added missing options to man pages - Updated EAP-TLS patch to v1.300 - Updated EAP-TLS patch to v1.201 - fix the Requires package name for teamd-devel - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852) - teamd: do no remove the ports on shutdown with -N (rhbz#2148854) - Rebuilt with a new version to pass the fixed gating test (rhbz#2060445) - utils/team2bond: do not add updelay/downdelay if already exist (rhbz#2060445) - utils/team2bond: do not add miimon if already exist (rhbz#2060445) - Revert "teamd: Disregard current state when considering port enablement" [1894546] - Remove an extra line in spec file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build util team2bond in teamd rpm [1986788] - Add some cautions to util team2bond [1986788] - Add team2bond man doc [1986788] - gating: fix the wrong link of openvswitch for RHEL-9 [1970175] - Replace statfs64 with statfs (RHEL-127105) - NFS export symlink vulnerability fix (RHEL-127105) - mountd: Minor refactor of get_rootfh() (RHEL-127105) - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105) - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105) - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105) - Add requires for selinux-policy (RHEL-127105) Resolves: CVE-2025-12801 - gssd: protect kerberos ticket cache access (RHEL-138462) - nfsrahead: modify get_device_info logic (RHEL-134397) - Fix dependency definition in rpc-statd.service (RHEL-116079) - ensure services are stopped when nfs-utils is uninstalled (RHEL-88422) - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408) - gssd: do not use krb5_cc_initialize (RHEL-85412) - mountstats: verify that old and new types are the same (RHEL-88553) - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143) - nfsd: allow more than 64 backlogged connections (RHEL-87752) - mountstats/nfsiostat: bugfixes for iostat (RHEL-72243) - Add nfs.conf to nfsv4-client-utils package (RHEL-72013) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase to 2.1.49 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update Japanese translation (rh #2083047) - Update to 1.26.0 release (rh #2066750) - Fix OWE settings disappearing on nm-connection-editor (rh #2057004) - Update to 1.24.0 release - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 1.22.0 release. - editor: show missing toggle in the 8021x-security page. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.20.0 release - Drop NotShowIn=GNOME - Use wireless-security code from libnma - Add flatpak build configuration - applet: hide unmanaged ethernet devices in nm-applet - applet: fix Wi-Fi scan requests with appindicator - editor: fix drop down list for connection.secondaries - Move desktop file to new nm-connection-editor-desktop package (rh #1923262) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Actually apply the patch for CVE-2024-27982 - Backport patch for CVE-2024-27982 - Use system OpenSSL configuration section - Backport patches for several CVEs. Fixes CVE-2024-22025 CVE-2024-25629 CVE-2024-27983 CVE-2024-28182 - Fix CVE-2024-22019 - Update version of bundled nghttp2 in spec file - Update bundled nghttp2 to 1.57.0 (CVE-2023-44487) - Rebase to 16.20.2 Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559 - Fix segfault that happens when processing fips-related options Resolves: BZ#2227796 - Rebase to 16.20.1 Resolves: rhbz#2188291 Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 - Replace /usr/etc/npmrc symlink with builtin configuration Resolves: rhbz#2177781 - NPM bundler: also find namespaced bundled dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix hard-coded output directory in the bundler - Update to 2021.06-1 - bundler: Handle archaic license metadata - bundler: Warn about bundled dependencies with no license metadata - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - nodejs-packaging-bundler improvements to handle uncommon characters - Add nodejs-packaging-bundler and update README.md - Move to dist-git as the upstream - Fix incorrect bundled library detection for Requires - Check node_modules_prod for bundled dependencies - NPM bundler: also find namespaced bundled dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix hard-coded output directory in the bundler - Update to 2021.06-1 - bundler: Handle archaic license metadata - bundler: Warn about bundled dependencies with no license metadata - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - nodejs-packaging-bundler improvements to handle uncommon characters - Add nodejs-packaging-bundler and update README.md - Move to dist-git as the upstream - Fix incorrect bundled library detection for Requires - Check node_modules_prod for bundled dependencies - fix incomplete ml-kem pct patch. - fix regression in -5 bug fix - fix a null in ml-dsa pkcs12 decode - fix return code in ml-kem pct - fips update - Fix indicators for the new post-quantum algorithms - Fix the ML-KEM Self-tests - Fix the ML-KEM zeroizaiton - Add partial public validation before OAEP - bug fixes - add CKA_SEED to private attributes so they are updated on password change. - mark CKA_PARAMETER_SET as CK_ULONG when storing into the database - fix unrefrence read in leancrypto. - fix interface issue when pulling 3.0 pkcs#11 interfaces explicitly - restore CONCATENATE functions accidentally removed in the last patch - fix big endian issue in tstclnt and selfserv in certificate compression - add fips required changes. - fix bugs found by QE - rebase to NSS 3.112 - add ml-kem-1024 support - add ml-dsa support - Allow RSA-OAEP in FIPS mode - Add SEC_OID_CURVE25519 to FIPS checks. - This will mark algorithms using it as FIPS unapproved. - fix pss issues (again) - fix pkcs12 defaults - fix pss issues - drop crmf - rebase fixes - restore rhel-9 dropping of pkcs12 and smime policy - restore mlkem aliases - add mlkem key lengths to the mechanism info - fix crash if you try to encapsulate with an unimported public key - restore distrusted certs to certdata.txt even though we never reference them to make tests happy. - rebase to upstream NSS 3.124 - backport ml-dsa support that is not upstream yet. - pick up in process patches upstream including eddsa - fix incomplete ml-kem pct patch. - fix regression in -5 bug fix - fix a null in ml-dsa pkcs12 decode - fix return code in ml-kem pct - fips update - Fix indicators for the new post-quantum algorithms - Fix the ML-KEM Self-tests - Fix the ML-KEM zeroizaiton - Add partial public validation before OAEP - bug fixes - add CKA_SEED to private attributes so they are updated on password change. - mark CKA_PARAMETER_SET as CK_ULONG when storing into the database - fix unrefrence read in leancrypto. - fix interface issue when pulling 3.0 pkcs#11 interfaces explicitly - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 9.3 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 9.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 9.1 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Drop explicit requires on javapackages-tools - Update to upstream version 9.7.1 - Resolves: rhbz#2316766 - Update to upstream version 9.7 - Resolves: rhbz#2271211 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 9.6 - Convert License tag to SPDX format - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 9.3 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 9.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 9.1 - Update to latest upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Drop explicit requires on javapackages-tools - Update to upstream version 9.7.1 - Resolves: rhbz#2316766 - Update to upstream version 9.7 - Resolves: rhbz#2271211 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 9.6 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Remove dependency on junit-bom - Update to version 3.4 - Resolves: rhbz#2279242 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Fix build with Java 11. - bumped to 3.1 - disabled javadoc generation. It requires maven pomming beyond my skills - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Remove dependency on junit-bom - Update to version 3.4 - Resolves: rhbz#2279242 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.11 - simplify spec - Resolves: RHEL-86603 - rebuild - Resolves: RHEL-69918 - rebuild - Resolves: RHEL-35939 - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.10 - Related: RHEL-2112 - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.9 - Related: #2176063 - rebuild for CVE-2026-33811 Resolves: RHEL-187325 - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.11 - simplify spec - Resolves: RHEL-86603 - rebuild - Resolves: RHEL-69918 - rebuild - Resolves: RHEL-35939 - Rebase to 1.9-beta1 - change of licences of ongres-scram and ongres-scram-javadoc to "BSD and MIT and ASL 2.0" - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Added junit dependency - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to 1.9-beta1 - change of licences of ongres-scram and ongres-scram-javadoc to "BSD and MIT and ASL 2.0" - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Added junit dependency - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to 13.0.10 [RHEL-144578] - Resolves: RHEL-144578 ([ESXi][RHEL9] open-vm-tools version 13.0.10 has been released - please rebase) - Rebase to 13.0.5 [RHEL-118505] - Resolves: RHEL-118505 ([ESXi][RHEL9] open-vm-tools version 13.0.5 has been released - please rebase) - ovt-Address-CVE-2025-41244.patch [RHEL-117392] - Resolves: RHEL-117392 ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-9.8]) - Rebase to 13.0.0 [RHEL-99158] - Resolves: RHEL-99158 ([ESXi][RHEL9] open-vm-tools version 13.0.0 has been released - please rebase) - Rebase to 12.5.0 [RHEL-63096] - Resolves: RHEL-63096 ([ESXi][RHEL9] open-vm-tools version 12.5.0 has been released - please rebase) - Rebase to 12.4.5 [RHEL-45547] - Resolves: RHEL-45547 ([ESXi][RHEL9] open-vm-tools version 12.4.5 has been released - please rebase) - ovt-Require-dbus-tools.patch [RHEL-35543] - Resolves: RHEL-35543 ([ESXi][open-vm-tools]The open-vm-tools should depend on dbus-tools) - Rebase to 12.4.0 [RHEL-30341 - Resolves: RHEL-30341 ([ESXi][RHEL9]open-vm-tools version 12.4.0 has been released - please rebase) - Rebase to 13.0.10 [RHEL-144578] - Resolves: RHEL-144578 ([ESXi][RHEL9] open-vm-tools version 13.0.10 has been released - please rebase) - Rebase to 13.0.5 [RHEL-118505] - Resolves: RHEL-118505 ([ESXi][RHEL9] open-vm-tools version 13.0.5 has been released - please rebase) - ovt-Address-CVE-2025-41244.patch [RHEL-117392] - Resolves: RHEL-117392 ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-9.8]) - Rebase to 13.0.0 [RHEL-99158] - Resolves: RHEL-99158 ([ESXi][RHEL9] open-vm-tools version 13.0.0 has been released - please rebase) - Rebase to 12.5.0 [RHEL-63096] - Resolves: RHEL-63096 ([ESXi][RHEL9] open-vm-tools version 12.5.0 has been released - please rebase) - Rebase to 12.4.5 [RHEL-45547] - Resolves: RHEL-45547 ([ESXi][RHEL9] open-vm-tools version 12.4.5 has been released - please rebase) - ovt-Require-dbus-tools.patch [RHEL-35543] - Resolves: RHEL-35543 ([ESXi][open-vm-tools]The open-vm-tools should depend on dbus-tools) - Rebase to 12.4.0 [RHEL-30341 - Resolves: RHEL-30341 ([ESXi][RHEL9]open-vm-tools version 12.4.0 has been released - please rebase) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Don't package some examples when SDL_sound is disabled - Only build SDL_sound support on Fedora and rhel < 9 - Resolves: rhbz#1989141 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Only build fluidsynth support on Fedora - Only build portaudio-backend on Fedora - Fix FTBFS (rhbz#1865148) - Set __cmake_in_source_build - BR qt5-qtbase-devel to keep the GUI frontend - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Don't package some examples when SDL_sound is disabled - Only build SDL_sound support on Fedora and rhel < 9 - Resolves: rhbz#1989141 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Only build fluidsynth support on Fedora - Only build portaudio-backend on Fedora - Fix FTBFS (rhbz#1865148) - Set __cmake_in_source_build - BR qt5-qtbase-devel to keep the GUI frontend - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Related: RHEL-114548 (Rebuild against samba 4.23) - Related: RHEL-89873 (Rebuild against samba 4.22) - Related: RHEL-59788 (Rebuild against samba 4.21) - Related: RHEL-33645 (Rebuild against samba 4.20) - Related: RHEL-114548 (Rebuild against samba 4.23) - Related: RHEL-89873 (Rebuild against samba 4.22) - Related: RHEL-59788 (Rebuild against samba 4.21) - Related: RHEL-33645 (Rebuild against samba 4.20) - Related: RHEL-114548 (Rebuild against samba 4.23) - Related: RHEL-89873 (Rebuild against samba 4.22) - Related: RHEL-59788 (Rebuild against samba 4.21) - Related: RHEL-33645 (Rebuild against samba 4.20) - fix two heap buffer overflows CVE-2024-56826 and CVE-2024-52827 (RHEL-72519,RHEL-72521) - Increase Epoch tag - Resolves: rhbz#2159637, rhbz#2218121, rhbz#2216042 - Revert v4.1.5 - Bump version - Resolves: rhbz#2159637, rhbz#2218121, rhbz#2216042 - Revert v4.1.2 - Add Epoch tag - Resolves: rhbz#2055184 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating.yaml - Initial build for RHEL 9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebase opensm to latest upstream release 3.3.24 - Resolves: bz1961963 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make - opensm service should after rdma-hw.target - Update systemd service file - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase opensm to latest upstream release 3.3.23 - Resolves: bz1813779 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Unpatch Red Hat help message - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Unpatch Red Hat help message - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Unpatch Red Hat help message - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276221 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: RHEL-276234 - CVE-2026-60000: Fix DoS via excessive GSSAPI authentication attempts Resolves: RHEL-276230 - CVE-2026-60001: Fix cases in GSSAPI and keyboard-interactive authentication where the minimum per-attempt delay was not being enforced Resolves: RHEL-258461 - CVE-2026-73283: Complete the fix of security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-245416 - CVE-2026-73281: Fix misinteraction between agent locking and the session-bind@openssh.com extension Resolves: RHEL-245424 - CVE-2026-73282: Fix information disclosure and data corruption via use-after-free in ssh client Resolves: RHEL-245419 - Fix CVE-2026-59995 OpenSSH: sftp client allows attacker to control downloaded file location Resolves: RHEL-236320 - Fix CVE-2026-59999 and CVE-2026-73283: Security bypass due to incorrect handling of forwarding and tunneling options Resolves: RHEL-236286 - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Unpatch Red Hat help message - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Move the redhat help message to debug1 log level Resolves: RHEL-104580 - Fix missing error codes set and invalid error code checks in OpenSSH. It prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS is on (CVE-2025-26465). Resolves: RHEL-78700 - Unpatch Red Hat help message - CVE-2026-59996: Fix remote glob result of ".." causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193178 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193024 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186439 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185836 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185854 - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164753 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166250 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166234 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166202 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166218 - Version bump - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155824 - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151580 - Enable support for DSA keys Resolves: RHEL-127624 - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-133959 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-133960 - Fix implicit destination path selection when source path ends with ".." Resolves: RHEL-119515 - Canonicalize username when matching a user Resolves: RHEL-118372 - Rebase to version 9.9 Resolves: RHEL-108912 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build with release flag - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build with release flag - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Bump version for upgrade with z-stream - Resolves: RHEL-50700 - Add patch for CVE-2024-40897 - Resolves: RHEL-50700 - Add AlmaLinux repositories - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Add AlmaLinux repositories - Bump release - Update to 165.1 - go.mod: update osbuild/images to v0.245.1, adding the PQC keys to the rhel-9 and rhel-10 rolling distribution repository configs - go.mod: update osbuild/images to 61b16700, enabling bootupd metadata generation for edge-commits including 9.6+ images - Test repository definitions are left at their upstream values - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Add AlmaLinux repositories - Update to 165.1 - go.mod: update osbuild/images to v0.245.1, adding the PQC keys to the rhel-9 and rhel-10 rolling distribution repository configs - go.mod: update osbuild/images to 61b16700, enabling bootupd metadata generation for edge-commits including 9.6+ images - Test repository definitions are left at their upstream values - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Add AlmaLinux repositories - go.mod: bump indirect golang.org/x/net dependency to v0.56.0 (CVE-2026-25681, CVE-2026-27136, CVE-2026-42502) - go.mod: update github.com/labstack/echo/v4 to v4.15.3 (CVE-2026-55677) - go.mod: update go.opentelemetry.io/otel to v1.44.0 (CVE-2026-41178) - Bump release - Update to 165.1 - go.mod: update osbuild/images to v0.245.1, adding the PQC keys to the rhel-9 and rhel-10 rolling distribution repository configs - go.mod: update osbuild/images to 61b16700, enabling bootupd metadata generation for edge-commits including 9.6+ images - Test repository definitions are left at their upstream values - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Update to upstream version 8.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 8.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 8.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 8.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Update to upstream version 8.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 8.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 8.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuild to regenerate OSGi metadata - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuild to regenerate OSGi metadata - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuild to regenerate OSGi metadata - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 8.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 8.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 8.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1961999 - Add gating tests - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fix incorrect fontconfig file (thanks to lazybvr) - update to 3.0.4 - Add junit to BR - Update pango-emoji-table.h for emoji 14 support - Add pango-update-emoji.patch - Resolves: #2119674 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 1.48.7 (#1981720) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.48.4 - Update to 1.48.3 - Disable gtk-doc support as we don't have gi-docgen in Fedora yet - Update to 1.48.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.48.1 - Update to 1.48.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - add support for cxl1.1 device link status information (#RHEL-29162) - add PCIe 6.0 data rate (64 GT/s) support (#RHEL-61959) - Fix the SAST reports described in RHEL-32492 and RHEL-32488 - Fix the SAST reports described in RHEL-32492 and RHEL-32488 - Fix SEGFAULT caused by dereferencing subject when length==0 on aarch64 - Resolves: RHEL-51866 - Rebuilt for added pcre2-tools into CRB - Fix an issue with restoring originally unset entries in recursion - Resolves: BZ#2248133 - Fix issue in the backtracking optimization of character in JIT - Backport multiple CVE fixes - CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161 - Backport --disable-polkit option (RHEL-34856) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1976942 remove build dependency on ant-contrib - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951271 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Require java-headless, rather than java - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1976942 remove build dependency on ant-contrib - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951271 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - allow rebuild with java 11 - Require java-headless, rather than java - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951270 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Related: rhbz#1951270 replace apache-commons-logging with java.util.logging - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Patch the code to use https instead of http (CVE-2024-45321) - Resolves: RHEL-56520 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 4.51 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 re-rebuild of bootstrapped packages - Perl 5.32 rebuild - 4.50 bump - 4.49 bump - Resolves: RHEL-77187 - Update man page - Resolves: RHEL-77187 - Fix permission for creating site directories - Resolves: rhbz#2218907 - Fix CVE-2023-31484 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - BR make - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - BR make - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix dependencies for ELN - Package tests - 2.101 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.100 bump - 2.096 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.095 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix dependencies for ELN - Package tests - 2.101 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.100 bump - 2.096 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.095 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - update to 3.000003 - Build-require blib for the tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix unsafe decoding in indef case (CVE-2013-7488) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Quote a substituted number of processors in the test script - Modernize spec file - Package upstream tests - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Package tests - 0.12 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Package tests - 0.12 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.41 - Adopt new repo structure - see: http://savage.net.au/Ron/html/My.Workflow.for.Building.Distros.html - Reformat Makefile.PL - Add t/00.* - Update POD to change RT to GitHub - Package new LICENSE file - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Spec tidy-up - Use author-independent source URL - Specify all build dependencies - Simplify Digest::MD5 versioned dependency generation using a patch - Simplify find command using -delete - Fix permissions verbosely - Make %files list more explicit - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Perl 5.30 rebuild - Resolves: RHEL-85011 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Upstream update to 0.24. - Upstream update to 0.23. - Reflect Source0-URL having changed. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 0.16 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 0.15 bump - 0.14 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 2.62 bump (2024a Olson database) - 2.60 bump (2023c Olson database) - Add test BR gcc and perl(blib) to not skip the tests - Package tests - Resolves: rhbz#2216280 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Resolves: RHEL-131157 - Update tests for Image Mode - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 7.60 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 7.58 bump - 7.56 bump - 7.54 bump - 7.52 bump - 7.50 bump - 7.48 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Spec tidy-up - Use author-independent source URL - Classify builds by usage - Drop redundant buildroot cleaning in %install section - Don't need to delete empty directories from the buildroot - Make %files list more explicit - Fix CVE-2025-40907 (integer overflow when parsing FastCGI parameters) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - BR: perl(blib) for t/00-compile.t and t/findorule.t - Update to 0.0312 - Rebuild for order of 'NAME' and 'VERSION' sections in the generated POD documentation (VERSION used to appear before NAME) - Update to 0.0311 - Moved the VCS repo to https://github.com/shlomif/perl-file-find-object-rule - Use 3 arg open in grep() (CVE-2011-10007) - Package tests - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.23 - Fixed a bug with the Makefile.PL that caused every call to "make" to recompile the object file for the package's XS code (GH#28) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Update to 1.22 - Removed embedded copy of Config::AutoConf from distro.; instead, this is now a configure phase prereq. (GH#19) - Moved list of constants in libmagic that we care about to one module (GH#20) - Add support for setting libmagic processing limits (GH#15, GH#22) - Add two class methods that provide introspection on the available limit processing parameters, max_param_constant() and limit_key_is_supported() (GH#24) - Check all libmagic function return values properly and croak on failure (GH#21) - Switched to using GitHub issues - Package CONTRIBUTING.md - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Explicitly BR: gcc on EL-8 because ExtUtils::CBuilder is missing dependency on it (#1547165) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 3.76 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Always build-require HTTP::Headers - 3.75 bump - 3.73 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 re-rebuild of bootstrapped packages - Perl 5.32 rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 6.29 bump - 6.28 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 6.27 bump - 6.26 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 re-rebuild - Perl 5.32 re-rebuild - Update man page for CVE-2023-31486 - Changes the verify_SSL default parameter from 0 to 1 - CVE-2023-31486 - Resolves: rhbz#2228412 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Package tests - 2.102 bump - 2.101 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.100 bump - Use %{make_build} and %{make_install} - 2.096 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.095 bump - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180418 - Update to 4.04 - Fix CVE-2025-40928 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Package tests manually - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 4.03 - Use %{make_install} instead of "make pure_install" - Use %{make_build} instead of make - Replace calls to %{__perl} with /usr/bin/perl - Pass NO_PACKLIST and NO_PERLLOCAL to Makefile.PL - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Specify all dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix resolving localhost on loopback-only machines (https://github.com/perl-ldap/perl-ldap/pull/60) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 0.68 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix tests subpackage test script - Fix a shell bang in a certificate generator script - Package tests - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Unbundle Module::Install - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 3.67 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 3.66 bump - 3.65 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - 3.64 bump - 3.63 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 3.67 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 3.66 bump - 3.65 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - 3.64 bump - 3.63 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - 0.15 bump - 0.14 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Modernize spec file - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Resolves: RHEL-5539 - 5.20240609 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Resolves: RHEL-68282 - Fix CVE-2024-10224 - Package tests - Update to 0.88 - Update PAUSE keys to 2022 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Perl 5.34 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 0.87 - Skip 3-verify.t on Crypt::OpenPGP installations - Perl 5.32 re-rebuild updated packages - Update to 0.86 - Update PAUSE and ANDK keys to 2020 - Update documentation pertaining to SHA1 - Fix compatibility with Crypt::OpenPGP - Use mktemp to create temporary GPG directory - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2.004004 - Update to 2.004003 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Update to 2.004000 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 2.003006 - Replace calls to %{__perl} with /usr/bin/perl - Replace calls to "make pure_install" with %{make_install} - Replace calls to make with %{make_build} - Pass NO_PERLLOCAL=1 to Makefile.PL - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - 0.19 bump - 0.18 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 0.17 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - version bump - Rebuilt with OpenSSL 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Perl 5.34 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - version bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - version bump - Perl 5.32 rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 6.21 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 6.20 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Perl 5.34 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 1.01 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Resolves: RHEL-92846 - Fix typo in macro - Fix test suite to work with OpenSSL 3.4.0 and newer Resolves: RHEL-92846 - Resolves: RHEL-40758 - Update to 1.94 - Net::SSLeay now officially supports all stable releases of OpenSSL 3.1 and 3.2, and LibreSSL 3.5-3.8 - Many noisy compiler warnings have been silenced - if SSLeay.xs fails to compile, it should now be much easier to identify the cause - libcrypto's OPENSSL_init_crypto() function and libssl's OPENSSL_init_ssl() function are now exposed, enabling fine-grained control over the initialisation and configuration of both libraries - libssl functions implementing TLS 1.3 PSK authentication are now exposed, in particular SSL_CTX_set_psk_find_session_callback() (on the server side) and SSL_CTX_set_psk_use_session_callback() (on the client side) - libssl functions implementing server-side TLS 1.2 PSK authentication are now exposed, in particular SSL_CTX_set_psk_server_callback() - libssl's SSL_CTX_set_client_hello_cb() function is now exposed, allowing a TLS server to set a callback function that is executed when the server processes a ClientHello message - Many more libcrypto/libssl constants and functions are now exposed; see the release notes for the 1.93 developer releases for a full list - Package tests - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 0.009 bump - Specfile autogenerated by cpanspec 1.78. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Add perl(blib) for tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix implied indenting in XS - Resolves: RHEL-28962 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 2.100 - Declare vars with our instead of use vars (GH#7) - Quote $VERSION to preserve formatting (GH#6) - Use %license unconditionally - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 2 - Switch to XSLoader rather than DynaLoader (GH#5) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Spec file cleanups: Use make_build and make_install macros, use NO_PACKLIST=1 - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make - https://fedoraproject.org/wiki/Perl/Tips#ExtUtils::MakeMaker - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.8 - Perldoc tweaks (GH#3) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 2.006006 bump - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Update to 0.002009 - Use %{make_install} instead of "make pure_install" - Use %{make_build} instead of make - Replace %{__perl} with /usr/bin/perl - Pass NO_PERLLOCAL to Makefile.PL - Perl 5.34 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.47 - Change Specio constraint object's stringification overloading to return the type name rather than the default Perl object stringification, which gives you something like "Specio::Constraint::Parameterized=HASH(0x564d258efb48)"; anonymous are special cased to return something you can print - All types now overload the 'eq' comparison operator: Moose expects types to be comparable in this manner when doing role summation (GH#18) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 re-rebuild of bootstrapped packages - Perl 5.32 rebuild - Update to 0.46 - Correct license of Specio::PartialDump (GH#17) - Correct a perl-Specio license to "Artistic 2.0 and (GPL+ or Artistic)" - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Update to 0.0600 - Avoid excessive callback calls by having the _path_cb take the $rule object (optimization) - Update to 0.0501 - Try to fix t/dogfood.t tests failures on MS Windows - Update to 0.0500 - Convert the file processing to use a code generated callback (a speed optimization) - Update to 0.0400 - Add the 'find_cr' and 'find_tabs' options - Module now requires Perl 5.14 - BR: perl(blib) for t/00-compile.t - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Specify all dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Adapt tests to changed Perl 5.30 (bug #1749253) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Spec tidy-up - Use author-independent source URL - Drop redundant buildroot cleaning in %install section - Specify more build dependencies - Simplify find command using -delete - Fix typo in %description - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Enable building with FreeType support - Package tests - Resolves: RHEL-25202 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.19 - Noted that the module is now deprecated - Added a list of alternatives to SEE ALSO - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Use author-independent source URL - Simplify find command using -delete - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 5.09 bump - Package tests - 5.08 bump - 5.07 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 5.06 bump - 5.05 bump - Modernize a spec file - Perl 5.32 re-rebuild of bootstrapped packages - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization Resolves: RHEL-275730 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Use make_* macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2006-10002, CVE-2006-10003 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Avoid trying to pull in Test::TrailingSpace for EL-8 builds - Resolves: rhbz#1989824 - Enable gating - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Use 3-arg form of open in LoadFile (CVE-2025-40908) - Resolves: RHEL-5537 - 1.13 bump - Package tests - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fixing CVE-2025-47151 Resolves: RHEL-126685 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Package talk-to-ourself script with the tests - 6.53 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 6.52 bump - 6.51 bump - 6.50 bump - 6.49 bump - 6.48 bump - Resolves: RHEL-43290 - Package tests - Resolves: RHEL-5538 - 5.20210520 bump - Package tests - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Some static analysis fixes for unitialized structs Resolves: RHEL-25498 - Fix a memory leak in parse_package() of repo conda (RHEL-25496) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178982) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir - Fixes: CVE-2023-47038 - Fixes: CVE-2026-13221 - Don't create a trie that would overflow - Resolves: RHEL-96651 - Fixes: CVE-2025-40909 - Clone dirhandles without fchdir - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - BR: perl(blib) for t/00-compile.t - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Honor the disabled rpath - Sync final version of coverity patches from upstream (#1938729) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Address few more minor issues reported by coverity - Fix issues reported by coverity - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pinentry-tty to separate subpackage (#1782442) - Update the wrapper selecting the appropriate version (#1918969) - New upstream release (#1919127) - enable pinentry-tty - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Honor the disabled rpath - Sync final version of coverity patches from upstream (#1938729) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Address few more minor issues reported by coverity - Fix issues reported by coverity - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pinentry-tty to separate subpackage (#1782442) - Update the wrapper selecting the appropriate version (#1918969) - New upstream release (#1919127) - enable pinentry-tty - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Honor the disabled rpath - Sync final version of coverity patches from upstream (#1938729) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Address few more minor issues reported by coverity - Fix issues reported by coverity - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Move pinentry-tty to separate subpackage (#1782442) - Update the wrapper selecting the appropriate version (#1918969) - New upstream release (#1919127) - enable pinentry-tty - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix CVE-2026-14324: limit RTSP Content-Length in RAOP client Resolves: RHEL-249297 - Fix stack exhaustion via unbounded alloca in pulse-server (CVE-2026-14330) Resolves: RHEL-249317 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164828 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164830 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Update to version 1.0.1 - Add patch to revert timestamps - Resolves: RHEL-17641, RHEL-21900 - Fix install conflict with older versions. - Resolves: RHEL-17641 - Update to version 1.0.0 - Add patch to avoid crash in deviceprovider. - Resolves: RHEL-17641 - Fix CVE-2026-14324: limit RTSP Content-Length in RAOP client Resolves: RHEL-249297 - Fix stack exhaustion via unbounded alloca in pulse-server (CVE-2026-14330) Resolves: RHEL-249317 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164828 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164830 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Update to version 1.0.1 - Add patch to revert timestamps - Resolves: RHEL-17641, RHEL-21900 - Fix install conflict with older versions. - Resolves: RHEL-17641 - Update to version 1.0.0 - Add patch to avoid crash in deviceprovider. - Resolves: RHEL-17641 - Fix CVE-2026-14324: limit RTSP Content-Length in RAOP client Resolves: RHEL-249297 - Fix stack exhaustion via unbounded alloca in pulse-server (CVE-2026-14330) Resolves: RHEL-249317 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164828 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164830 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Update to version 1.0.1 - Add patch to revert timestamps - Resolves: RHEL-17641, RHEL-21900 - Fix install conflict with older versions. - Resolves: RHEL-17641 - Update to version 1.0.0 - Add patch to avoid crash in deviceprovider. - Resolves: RHEL-17641 - Fix CVE-2026-14324: limit RTSP Content-Length in RAOP client Resolves: RHEL-249297 - Fix stack exhaustion via unbounded alloca in pulse-server (CVE-2026-14330) Resolves: RHEL-249317 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164828 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164830 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Update to version 1.0.1 - Add patch to revert timestamps - Resolves: RHEL-17641, RHEL-21900 - Fix install conflict with older versions. - Resolves: RHEL-17641 - Update to version 1.0.0 - Add patch to avoid crash in deviceprovider. - Resolves: RHEL-17641 - Fix CVE-2026-14324: limit RTSP Content-Length in RAOP client Resolves: RHEL-249297 - Fix stack exhaustion via unbounded alloca in pulse-server (CVE-2026-14330) Resolves: RHEL-249317 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164828 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164830 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Update to version 1.0.1 - Add patch to revert timestamps - Resolves: RHEL-17641, RHEL-21900 - Fix install conflict with older versions. - Resolves: RHEL-17641 - Update to version 1.0.0 - Add patch to avoid crash in deviceprovider. - Resolves: RHEL-17641 - Fix CVE-2026-14324: limit RTSP Content-Length in RAOP client Resolves: RHEL-249297 - Fix stack exhaustion via unbounded alloca in pulse-server (CVE-2026-14330) Resolves: RHEL-249317 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164828 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164830 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Rebase to 1.4.9 Resolves: RHEL-123614 - Rebase to 1.4.6 Resolves: DESKTOP-2312 - Rebase to 1.0.7 - Update to version 1.0.1 - Add patch to revert timestamps - Resolves: RHEL-17641, RHEL-21900 - Fix install conflict with older versions. - Resolves: RHEL-17641 - Update to version 1.0.0 - Add patch to avoid crash in deviceprovider. - Resolves: RHEL-17641 - Update to version 2.19.1 - Resolves: RHEL-100233 - Update to version 2.21 - Resolves: RHEL-188300 - Update to version 2.19.1 - Resolves: RHEL-100233 - Rebase to version 2.19.1 - Resolves: RHEL-100270 - Rebase to version 2.16.0 - Rebase to version 2.21.4 - Resolves: RHEL-190943 - Rebase to version 2.19.1 - Resolves: RHEL-100270 - Rebase to version 2.21.6 - Resolves: RHEL-259228 - Rebase to version 2.21.4 - Resolves: RHEL-190943 - Rebase to version 2.19.1 - Resolves: RHEL-100270 - Update to version 2.19.1 - Resolves: RHEL-100239 - Update to version 2.21.4 - Resolves: RHEL-190937 - Update to version 2.19.1 - Resolves: RHEL-100239 - Rebase to version 2.21.6 - Resolves: RHEL-259228 - Update to version 2.21.4 - Resolves: RHEL-190937 - Update to version 2.19.1 - Resolves: RHEL-100239 - Update to version 2.19.1 - Resolves: RHEL-100239 - Update to version 2.21.4 - Resolves: RHEL-190937 - Update to version 2.19.1 - Resolves: RHEL-100239 - Rebase to version 2.21.6 - Resolves: RHEL-259228 - Update to version 2.21.4 - Resolves: RHEL-190937 - Update to version 2.19.1 - Resolves: RHEL-100239 - Update to version 2.19.1 - Resolves: RHEL-100239 - Update to version 2.21.4 - Resolves: RHEL-190937 - Update to version 2.19.1 - Resolves: RHEL-100239 - Rebase to version 2.21.6 - Resolves: RHEL-259228 - Update to version 2.21.4 - Resolves: RHEL-190937 - Update to version 2.19.1 - Resolves: RHEL-100239 - Update to version 2.19.1 - Resolves: RHEL-100245 - Update to version 2.21.4 - Resolves: RHEL-190947 - Update to version 2.19.1 - Resolves: RHEL-100245 - Rebase to version 2.21.6 - Resolves: RHEL-259228 - Update to version 2.21.4 - Resolves: RHEL-190947 - Update to version 2.19.1 - Resolves: RHEL-100245 - Rebase to version 2.19.2 - Resolves: RHEL-100270 - Rebase to version 2.16 - Rebase to version 2.21 - Resolves: RHEL-188300 - Rebase to version 2.19.2 - Resolves: RHEL-100270 - Fix CVE-2026-89058: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config - Fix CVE-2026-89059: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) - Resolves: RHEL-278032 - Resolves: RHEL-277999 - Fix CVE-2026-17615: SourceProvider remote unauthenticated file read Resolves: RHEL-251553 - Fix CVE-2026-17615: SourceProvider remote unauthenticated file read Resolves: RHEL-251553 - Bump release to rebuild - Adjusted the postun scriptlets to enable upgrading to RHEL 9 - Resolves: rhbz#1933055 - Update javapackages test plan to f42 - Update to upstream version 4.10.0 - Resolves: rhbz#2269638 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 4.9.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.9.0 - Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 4.2.7 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 4.2.4 - Update to version 4.2.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Update javapackages test plan to f42 - Update to upstream version 4.10.0 - Resolves: rhbz#2269638 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 4.9.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.9.0 - Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to upstream version 4.2.4 - Update to version 4.2.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Update to version 4.2.3. - Update to upstream version 4.2.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 4.2.7 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to upstream version 4.2.4 - Update to version 4.2.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.8 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Unecessary restriction on plexus-util, with the patch it's actually still source compatible with older versions - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.8 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rename plexus-build-api to plexus-build-api0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Install license files in licensedir instead of docdir - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rename plexus-build-api to plexus-build-api0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to version 1.8 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to version 1.8 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing test dependency on JUnit 4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing test dependency on JUnit 4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing test dependency on JUnit 4 - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 2.7.0 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.15.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.15.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Non-bootstrap build - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.15.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Non-bootstrap build - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.11.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.15.0 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Non-bootstrap build - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.8 - Update to version 2.8.8. - Update to version 2.8.7. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 6.5 - Update to version 6.5. - Update to upstream version 6.4 - Update to version 6.4. - Update to upstream version 6.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 6.6 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 6.5 - Update to version 6.5. - Update to upstream version 6.4 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 2.1.1 - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing test dependency on JUnit 4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing test dependency on JUnit 4 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Add missing test dependency on JUnit 4 - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2295800 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Update to upstream version 3.2.0 - Update javapackages test plan to f42 - Update to upstream version 3.5.0 - Resolves: rhbz#2295800 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Add patch for SUREFIRE-1897 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 1.0.6. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.0.6 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.2.0 - Convert License tag to SPDX format - Update to upstream version 1.1.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to version 1.0.6. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.0.6 - Rebuild correctly as a proper JPMS module - Bootstrap restoration of essential JPMS classes - Update to upstream version 1.0.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.1.1 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Add patch for SUREFIRE-1897 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 1.0.6. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 1.0.6 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.2.0 - Convert License tag to SPDX format - Update to upstream version 1.1.2 - Update javapackages test plan to f42 - Update to upstream version 18 - Resolves: rhbz#2267817 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 15 - Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update to version 7. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7 - Update to upstream version 6.5 - Update to version 6.5. - Update to upstream version 6.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 8 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 7. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7 - Update to upstream version 6.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Mass rebuild for javapackages-tools 201902 - Update to version 1.1.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 1.2.0 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to version 2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to version 2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Initial packaging - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Initial packaging - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.1 - Update javapackages test plan to f42 - Update to upstream version 3.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Initial packaging - Update javapackages test plan to f42 - Update to upstream version 3.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - bump of release for for java-21-openjdk as system jdk - Initial packaging - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating.yaml - Address important covscan issues (#1938846) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Conditionalize static subpackage during build-time - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to popt 1.18 final (no changes from rc1) - Rebase to popt 1.18-rc1 - Update URLs to the new upstream - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bundle shaded ongres-* dependencies - rebase to 42.2.28 - fix for CVE-2024-1597 - Add tests for CVE-2026-42198 - Fix CVE-2026-42198: limit SCRAM PBKDF2 iterations to prevent DoS - Resolves: RHEL-173489 - Bundle shaded ongres-* dependencies - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - rebuild for libpq ABI fix rhbz#1908268 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebase to upstream release 12.02.0000 - Rebase to upstream release 12.01.0000 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.16. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.16. - Update to 0.21 - Support multi-drivers mode and amdgpu - Support dynamically adjusts amd-pstate EPP values between battery and AC modes. - Resolves: RHEL-23395 - Update date to 0.13 - Support for AMD P-State - Resolves: rhbz#2226568 + power-profiles-daemon-0.11.1-1 - Update to 0.11.1 - Resolves: rhbz#2080280 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fixed man page and typo in the built-in help - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - fixup tmpfile to use /run instead of /var/run - Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112700) - Ignore signatures made by unknown or disabled algorithms (RHEL-112700) - Fix rpmsign(8) man page (RHEL-109233) - Additional PQC-related fixes (RHEL-109233) - Add signing support (RHEL-107536) - Initial commit on c9s (RHEL-84699) - Fix key import API to return NOTTRUSTED for disabled algorithms (RHEL-112700) - Ignore signatures made by unknown or disabled algorithms (RHEL-112700) - Fix rpmsign(8) man page (RHEL-109233) - Additional PQC-related fixes (RHEL-109233) - Add signing support (RHEL-107536) - Initial commit on c9s (RHEL-84699) - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Rebuild - Rebuild - Applied patch for CVE-2022-1941 (#RHEL-40872) - Applied patch to make emacs dependency optional (#RHEL-40572) - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Rebuild - Rebuild - Applied patch for CVE-2022-1941 (#RHEL-40872) - Applied patch to make emacs dependency optional (#RHEL-40572) - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Rebuild - Rebuild - Applied patch for CVE-2022-1941 (#RHEL-40872) - Applied patch to make emacs dependency optional (#RHEL-40572) - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Rebuild - Rebuild - Applied patch for CVE-2022-1941 (#RHEL-40872) - Applied patch to make emacs dependency optional (#RHEL-40572) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - update to 0.21.1 (#1858489) - fix unnecessary build failure due to missing tree_index.sgml in gtk-doc output - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - update to 0.21.1 (#1858489) - fix unnecessary build failure due to missing tree_index.sgml in gtk-doc output - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable ImageMagick support in ELN/RHEL 8+ as ImageMagick isn't part of it - Rebase to 3.75 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1962000 - Add missing gating tests - Resolves:rhbz#1962000 - Add gating tests from rhel-8 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 20141121-18 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 20141121-16 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 20141121-15 💥 Actually rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 20141121-14 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - Rebuild for autostart fix Resolves: RHEL-40601 - Rebuild for autostart fix Resolves: RHEL-40601 - Rebuild for autostart fix Resolves: RHEL-40601 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Disable tests that use genisoimage Resolves: rhbz#1972212 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream 1.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to upstream version 1.9.0 - Rebuilt for Python 3.8.0rc1 (#1748018) - fix building docs - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix an IndexError when generating toctree (rhbz#1930910) - New upstream release 4.27.0 (rhbz#1918566, rhbz#1929448) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release 4.26.0 (rhbz#1914147) - New upstream release 4.25.1 (rhbz#1908213) - New upstream release 4.24.1 (rhbz#1903366) - New upstream release 4.24.0 (rhbz#1897984) - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Related: rhbz#1990421 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.14.5 Resolves: rhbz#1927933 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.14.3 - Update to 1.14.2 (#1869032) - Update to 1.14.1 - Fixes: rhbz#1860698 - Fixes: rhbz#1865276 - Rebuilt for Python 3.9 - Update to 0.1.18 - Don't print empty requires - Remove Python 2 support - Fix issues detected by static analyzers - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.1.16 - Fix a crash when clearing COMPS_ObjRTree (RhBug:1888343) - Fix memory leaks and resource leaks - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - spec: Fix building with new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Fix CVE-2022-40023 (#2133606) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Remove unnecessary python3-mock BuildRequires - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 1.1.4 - Avoids test warnings on Python 3.10 Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1907474 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Add manual Obsoletes for python39-psycopg2-doc - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - rebuild for libpq ABI fix rhbz#1908268 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to upstream version 2.8.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebase to upstream version 2.8.5 - Resolves: RHEL-148154 - Fix CVE-2026-59886: prevent overflow in Real type float conversion - Resolves: RHEL-217915 - Resolves: RHEL-148154 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Don't BuildRequire python3-hypothesis and exclude affected tests from %check - Resolves: rhbz#1928125 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Parallelize Sphinx documentation build - Use the GitHub tarball instead of the PyPI tarball - Switch URL to HTTPS - Replace pypi_name macro with srcname - Update BR’s - Run the doctests - Build documentation in a new -doc subpackage - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - update to version 0.17.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - 5.15.9 Resolves: bz#2175758 - 5.15.6 + sync with Fedora Resolves: bz#2061728 - Rebuild (Qt 5.15.3) Resolves: bz#2061728 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove benchmarking files from sources - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Update to current version - 1.4.45 Resolves: rhbz#2152649 - Remove obsolete cruft from the specfile, follow the packaging guidelines - Remove also extra packages we have no runtime dependencies for Related: rhbz#2084556 - Add python-sqlalchemy to RHEL-9 Resolves: rhbz#2084556 - version 1.4.37 - version 1.4.36 - version 1.4.35 - version 1.4.34 - version 1.4.32 - don't BR: python3-pytest-xdist on EL9 - remove obsolete (no-op) tweak of setup.cfg - version 1.4.31 - version 1.4.29 - Remove weak dependency on doc subpackage (RHEL-5835) - Update to 6.5.10 Resolves: RHEL-274870 - Update to 6.5.8 Resolves: RHEL-247281 - Update to 6.5.5 Resolves: RHEL-160942 - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91998 - Bump release to prevent clash with 9.5.z NVR Resolves: RHEL-68667 - Update to 6.4.2 Resolves: RHEL-68667 - Update to 6.5.5 Resolves: RHEL-160942 - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91998 - Bump release to prevent clash with 9.5.z NVR Resolves: RHEL-68667 - Update to 6.4.2 Resolves: RHEL-68667 - Update to 6.5.8 Resolves: RHEL-247281 - Update to 6.5.5 Resolves: RHEL-160942 - httputil: Raise errors instead of logging in multipart/form-data parsing Resolves: RHEL-91998 - Bump release to prevent clash with 9.5.z NVR Resolves: RHEL-68667 - Update to 6.4.2 Resolves: RHEL-68667 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new release - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new release to fix testsuite against Python 3.9 - new release - new release - Update to 1.31.62 - Skip two tests that exceed the min/max epoch time on RHEL - Add gating configuration - 1.31.38 - 1.31.37 - 1.31.36 - 1.31.35 - 1.31.34 - 1.31.33 - 1.31.32 - fix building docs - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Fix an IndexError when generating toctree (rhbz#1930910) - New upstream release 4.27.0 (rhbz#1918566, rhbz#1929448) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release 4.26.0 (rhbz#1914147) - New upstream release 4.25.1 (rhbz#1908213) - New upstream release 4.24.1 (rhbz#1903366) - New upstream release 4.24.0 (rhbz#1897984) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Update to 6.2 - Provide the extra toml package (rhbz#2010422) - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for Python 3.10 - 5.6b1 - update to 5.5 - update to 5.4 - update to 5.3.1 - update to 5.3 - update to 5.2.1 - Update to 6.2 - Provide the extra toml package (rhbz#2010422) - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for Python 3.10 - 5.6b1 - update to 5.5 - update to 5.4 - update to 5.3.1 - update to 5.3 - update to 5.2.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 + python-dbusmock-0.22.0-3 - Add bluez agent templates for the benefit of gnome-bluetooth - Remove redundant dependency on python3-nose + python-dbusmock-0.22.0-1 - Update to 0.22.0 - Disable tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + python-dbusmock-0.18.3-2 - Add low-memory-monitor mock - Latest upstream, resolves: rhbz#1938360 - Convert to pyproject macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix missing %dist - Rebuilt for Python 3.10 - Latest upstream rhbz#1938360 - Fix FTBFS with PyYAML 5.4.1 rhbz#1917364 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - BuildRequire six explicitly, it's used in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Resolves: rhbz#1981868 - Resolves: rhbz#2166716 - Update to 3.12.3 - Add smbios3 support. - Resolves: rhbz#1938852 - Resolves: rhbz#1992494 Related: rhbz#1991688 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix several issues found by covscan - Resolves: rhbz#1938852 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Ensure dns.rdtypes subpackages are available Related: RHEL-32663 - Add missing files due to build change from hatchling to setuptools Related: RHEL-32663 - Rebase to 2.6.1 Resolves: RHEL-32628, RHEL-32663 - Fix build for legacy setup.py Related: rhbz#2177854 - Rebase to version 2.3.0 Resolves: rhbz#2177854 - Remove pycache from patch 0003. Related: rhbz#2107651 - Rebase to version 2.2.1 Resolves: rhbz#2088661 - Disable DNSSEC tests using SHA1 due to crypto policies Resolves: rhbz#2107651 - Ensure dns.rdtypes subpackages are available Related: RHEL-32663 - Add missing files due to build change from hatchling to setuptools Related: RHEL-32663 - Rebase to 2.6.1 Resolves: RHEL-32628, RHEL-32663 - Fix build for legacy setup.py Related: rhbz#2177854 - Rebase to version 2.3.0 Resolves: rhbz#2177854 - Remove pycache from patch 0003. Related: rhbz#2107651 - Rebase to version 2.2.1 Resolves: rhbz#2088661 - Disable DNSSEC tests using SHA1 due to crypto policies Resolves: rhbz#2107651 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 4.19.1 version (#1921968) - Update to 4.19.0 version (#1920265) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 4.18.2 version (#1908485) - Update to 4.18.1 version (#1906095) - Update to 4.18.0 version (#1904631) - Update to 4.17.1 version (#1898343) - Update to 4.17.0 version (#1897467) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 4.19.1 version (#1921968) - Update to 4.19.0 version (#1920265) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 4.18.2 version (#1908485) - Update to 4.18.1 version (#1906095) - Update to 4.18.0 version (#1904631) - Update to 4.17.1 version (#1898343) - Update to 4.17.0 version (#1897467) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 4.19.1 version (#1921968) - Update to 4.19.0 version (#1920265) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 4.18.2 version (#1908485) - Update to 4.18.1 version (#1906095) - Update to 4.18.0 version (#1904631) - Update to 4.17.1 version (#1898343) - Update to 4.17.0 version (#1897467) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1945164 - Remove dependency on python-pytest-randomly - disable tests - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add missing BR: python3-setuptools - Disable few tests temporary for now (rhbz#1820916, rhbz#1841708) - Rebuilt for Python 3.9 - enable tests and use upstream source tarball - Initial packaging - Rebase to the latest upstream 0.14.3 (RHEL-88597) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Removing tests - Resolves: rhbz#1918839 - Resolves: rhbz#1945223 - Resolves: rhbz#1922337 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 1.0.5 - Enable tests for F34 (#1896191 has been resolved) - Temporarily run tests on Fedora < 34 only - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - 1.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add make to BuildRequires - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8 - Add generated Requires on multiple versions of java-headless - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Drop ExclusiveArch - Rebuilt for Drop i686 JDKs - Update to upstream version 6.1.0 - Introduce javapackages-extra and javapackages-common subpackages - Drop metadata for com.sun:tools and sun.jdk:jconsole - Re-enable tests - Re-add manpages - Drop bootstrap mode - Rebuilt for Python 3.11 - Install toolchains.xml in correct location in bootstrap mode - Switch to OpenJDK 17 as default JDK/JRE - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Drop JRE 21 fallback patch - Drop JRE 21 fallback patch - Add maven-local dependency on xmvn-toolchain - Update to upstream version 6.4.0 - Revert "Ensure that maven-openjdk21 is used with maven-local-openjdk21" - Ensure that maven-openjdk21 is used with maven-local-openjdk21 - jp-local-openjdk21 should conditionally require ant-openjdk21 - Update to upstream version 6.3.4 - Resolves: rhbz#2317773 - Update to upstream version 6.3.3 - Resolves: rhbz#2317032 - Update to upstream version 6.3.2 - Resolves: rhbz#2316487 - Rebuild to get -devel in compose - Resolves: RHEL-45353 - Rebase to upstream v0.5.5 Resolves: RHEL-86262 - Rebase to upstream v0.5.4 Resolves: RHEL-67143 - Add tests/ directory - Add gating.yaml to RHEL9 libkdumpfile - Update to 0.5.2 - Use SPDX license identifiers - Fix documentation build to be properly be noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - related: rhbz#2048653 - Add package to CRB - related: rhbz#2028819 - Update to version 1.1.4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Build using new cmake macros - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add patch to correct 'extern "C"' usage - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: #1913613 (Disable DII (and ImageMagic dependency) for RHEL 9) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for Boost 1.75 - FTBFS fix: %{__python} must now be explicitly defined - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Cleanup conditionals for using python3 - Rebuilt for Boost 1.73 - create temporary edit files at symlink target location (RHEL-85754) - allow 32 char usernames (#RHEL-55983) - Update translations Resolves: RHEL-12110 - Fix findings from static application security testing Resolves: RHEL-35693 - Translation update Resolves: rhbz#2139662 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - New upstream release - New upstream release - Add requires systemtap-sdt-devel to lttng-ust-devel (#1386412) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Enable SystemTAP SDT support (#1386412) - Add patch to fix build failure with GCC 10 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - BuildRequire python3-setuptools explicitly - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Rebuilt for Python 3.10 - Bootstrap for Python 3.10 - Deprecate python3-mock - https://fedoraproject.org/wiki/Changes/DeprecatePythonMock - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - BuildRequire six to fix a build failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Bootstrap for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1960905 : License corrected to ASL 2.0 - Resolves: rhbz#1960905 : License corrected to ASL 2.0 - See upstream commit 4bdf076 and release 1.0.7 - Added CI tests - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - fix ppc64le test failures (RHEL-88575) - Update to 1.23.5 - Resolves: RHEL-5520 - Update to 2.0.36 - update to https://github.com/containers/podman-py/releases/tag/v5.7.0 - Related: RHEL-111919 - update to https://github.com/containers/podman-py/releases/tag/v5.6.0 - Related: RHEL-111919 - update to https://github.com/containers/podman-py/releases/tag/v5.5.0 - Related: RHEL-80816 - update to https://github.com/containers/podman-py/releases/tag/v5.4.0.1 - Resolves: RHEL-81952 - update to https://github.com/containers/podman-py/releases/tag/v5.3.0 - Resolves: RHEL-69140 - update to https://github.com/containers/podman-py/releases/tag/v5.2.0 - Related: RHEL-27608 - update to https://github.com/containers/podman-py/releases/tag/v5.0.0 - Resolves: RHEL-30257 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Add manual Obsoletes for python39-psycopg2-doc - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - rebuild for libpq ABI fix rhbz#1908268 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to upstream version 2.8.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebase to upstream version 2.8.5 - Add automatically generated Obsoletes tag with the python39- prefix for smoother upgrade from RHEL8 - Add manual Obsoletes for python39-psycopg2-doc - Related: rhbz#1990421 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - rebuild for libpq ABI fix rhbz#1908268 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to upstream version 2.8.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebase to upstream version 2.8.5 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Enable CI. Related: rhbz#1956213 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Updated to 1.5.34. - Updated to 1.5.29. - Avoid dependency on python-pbr, conditionalize docs build, to allow building in RHEL. Inspired by python-sushy. - Updated to 1.5.19. - Updated to 1.5.16. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Relax dateutil requirement in requirement.txt as well (#1835084) - Rebuilt for Python 3.9 - Fix typo in requirements - Updated to 1.5.14. - Add py_ssize_t_clean module support for compatibility with python-qt5 Resolves: RHEL-27554 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - New upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - New upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove benchmarking files from sources - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 1.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for Python 3.8.0rc1 (#1748018) - Rebuilt for Python 3.8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Band-aid clap pre-release version - Update to 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Update to 15 - Update to 14 - Use 'cargo install --no-track' with cargo 1.41 - Rebuild against json-c-0.14-11 Related: rhbz#2023326 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version - lib: Use GLib for computing SHA-1 digests - sr_distances_cluster_objects: Check arg safety - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version - Fix builds with python3.10 - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1898063 - New upstream version - Fix leaks in koops stacktrace- and report-handling code - Replace utility code with GLib functions - Fix unit test portability issue - Add build dependency on make - Remove #define PyString_AsString PyUnicode_AsUTF8 - python: Adapt to changes made in PEP 590 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to current version - 1.4.45 Resolves: rhbz#2152649 - Remove obsolete cruft from the specfile, follow the packaging guidelines - Remove also extra packages we have no runtime dependencies for Related: rhbz#2084556 - Add python-sqlalchemy to RHEL-9 Resolves: rhbz#2084556 - version 1.4.37 - version 1.4.36 - version 1.4.35 - version 1.4.34 - version 1.4.32 - don't BR: python3-pytest-xdist on EL9 - remove obsolete (no-op) tweak of setup.cfg - version 1.4.31 - version 1.4.29 - Update to current version - 1.4.45 Resolves: rhbz#2152649 - Remove obsolete cruft from the specfile, follow the packaging guidelines - Remove also extra packages we have no runtime dependencies for Related: rhbz#2084556 - Add python-sqlalchemy to RHEL-9 Resolves: rhbz#2084556 - version 1.4.37 - version 1.4.36 - version 1.4.35 - version 1.4.34 - version 1.4.32 - don't BR: python3-pytest-xdist on EL9 - remove obsolete (no-op) tweak of setup.cfg - version 1.4.31 - version 1.4.29 - Update to current version - 1.4.45 Resolves: rhbz#2152649 - Remove obsolete cruft from the specfile, follow the packaging guidelines - Remove also extra packages we have no runtime dependencies for Related: rhbz#2084556 - Add python-sqlalchemy to RHEL-9 Resolves: rhbz#2084556 - version 1.4.37 - version 1.4.36 - version 1.4.35 - version 1.4.34 - version 1.4.32 - don't BR: python3-pytest-xdist on EL9 - remove obsolete (no-op) tweak of setup.cfg - version 1.4.31 - version 1.4.29 - Update to current version - 1.4.45 Resolves: rhbz#2152649 - Remove obsolete cruft from the specfile, follow the packaging guidelines - Remove also extra packages we have no runtime dependencies for Related: rhbz#2084556 - Add python-sqlalchemy to RHEL-9 Resolves: rhbz#2084556 - version 1.4.37 - version 1.4.36 - version 1.4.35 - version 1.4.34 - version 1.4.32 - don't BR: python3-pytest-xdist on EL9 - remove obsolete (no-op) tweak of setup.cfg - version 1.4.31 - version 1.4.29 - Rebase to version 2.4.3 - resolves: RHEL-89882 - resolves: RHEL-33758 - Rebase to version 2.4.2 - resolves: RHEL-16479 - Rebase to version 2.4.1 - resolves: rhbz#2190418 - Rebuilt to retrigger brew build - Update to 4.65.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 4.64.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for Python 3.11 - Bootstrap for Python 3.11 - Update to 4.63.1 - Update to 4.63.0 - Add package.cfg - Run tests in %check - backport bootctl fix for 99-uki-uefi-setup.install - Resolves: RHEL-84984 - update to version 24.11 - Resolves: RHEL-69507 - update to version 24.7 - update to version 24.4 - update to version 24.2 - update to version 24.1.1 - update to version 24.1 - Resolves: RHEL-21090 - add "obsoletes: rhel-cvm-update-tool" to uki-direct - add uki-direct subpackage - Resolves: RHEL-19383 - update to version 23.11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Enable upstream test suite - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Update to upstream version 2.0.0 - Update to version 2.0.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Enable upstream test suite - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update to upstream version 2.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.3 - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187] - kvm-q35-increase-default-tseg-size.patch [RHEL-139057] - Resolves: RHEL-132989 (Expose block limits of block nodes in QMP and qemu-img [rhel-9]) - Resolves: RHEL-140187 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8]) - Resolves: RHEL-139057 ([qemu, rhel-9] increase default TSEG size) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207387] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207387] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207387] - Resolves: RHEL-207387 (qemu-img create/convert fails on target block device with 4k sector size [rhel-9.8.z]) - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187] - kvm-q35-increase-default-tseg-size.patch [RHEL-139057] - Resolves: RHEL-132989 (Expose block limits of block nodes in QMP and qemu-img [rhel-9]) - Resolves: RHEL-140187 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8]) - Resolves: RHEL-139057 ([qemu, rhel-9] increase default TSEG size) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240] - Resolves: RHEL-138240 (QEMU crashes when stopping source VM during live migration [rhel-9]) - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193] - Resolves: RHEL-132193 ([rhel 9.8]L1VH qemu downstream initial merge RHEL9) - kvm-pcie_sriov-make-pcie_sriov_pf_exit-safe-on-non-SR-IO.patch [RHEL-131144] - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-132193] - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-132193] - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-132193] - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-132193] - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-132193] - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-132193] - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-132193] - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-132193] - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-132193] - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-132193] - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-132193] - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-132193] - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-132193] - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-132193] - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-132193] - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-132193] - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-132193] - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-132193] - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-132193] - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-132193] - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-132193] - kvm-docs-Add-mshv-to-documentation.patch [RHEL-132193] - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-132193] - kvm-accel-mshv-initialize-thread-name.patch [RHEL-132193] - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-132193] - Resolves: RHEL-131144 (qemu crash after hot-unplug disk from the multifunction enabled bus [RHEL.9.8]) - Resolves: RHEL-132193 ([rhel 9.8]L1VH qemu downstream initial merge RHEL9) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187] - kvm-q35-increase-default-tseg-size.patch [RHEL-139057] - Resolves: RHEL-132989 (Expose block limits of block nodes in QMP and qemu-img [rhel-9]) - Resolves: RHEL-140187 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8]) - Resolves: RHEL-139057 ([qemu, rhel-9] increase default TSEG size) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207387] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207387] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207387] - Resolves: RHEL-207387 (qemu-img create/convert fails on target block device with 4k sector size [rhel-9.8.z]) - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187] - kvm-q35-increase-default-tseg-size.patch [RHEL-139057] - Resolves: RHEL-132989 (Expose block limits of block nodes in QMP and qemu-img [rhel-9]) - Resolves: RHEL-140187 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8]) - Resolves: RHEL-139057 ([qemu, rhel-9] increase default TSEG size) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240] - Resolves: RHEL-138240 (QEMU crashes when stopping source VM during live migration [rhel-9]) - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193] - Resolves: RHEL-132193 ([rhel 9.8]L1VH qemu downstream initial merge RHEL9) - kvm-pcie_sriov-make-pcie_sriov_pf_exit-safe-on-non-SR-IO.patch [RHEL-131144] - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-132193] - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-132193] - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-132193] - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-132193] - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-132193] - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-132193] - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-132193] - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-132193] - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-132193] - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-132193] - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-132193] - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-132193] - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-132193] - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-132193] - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-132193] - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-132193] - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-132193] - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-132193] - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-132193] - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-132193] - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-132193] - kvm-docs-Add-mshv-to-documentation.patch [RHEL-132193] - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-132193] - kvm-accel-mshv-initialize-thread-name.patch [RHEL-132193] - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-132193] - Resolves: RHEL-131144 (qemu crash after hot-unplug disk from the multifunction enabled bus [RHEL.9.8]) - Resolves: RHEL-132193 ([rhel 9.8]L1VH qemu downstream initial merge RHEL9) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187] - kvm-q35-increase-default-tseg-size.patch [RHEL-139057] - Resolves: RHEL-132989 (Expose block limits of block nodes in QMP and qemu-img [rhel-9]) - Resolves: RHEL-140187 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8]) - Resolves: RHEL-139057 ([qemu, rhel-9] increase default TSEG size) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207387] - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207387] - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207387] - Resolves: RHEL-207387 (qemu-img create/convert fails on target block device with 4k sector size [rhel-9.8.z]) - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527] - Resolves: RHEL-184527 (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z]) - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951] - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951] - Resolves: RHEL-184951 (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z]) - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008] - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008] - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008] - Resolves: RHEL-166008 (live migration failed the VM just register key only [rhel-9.8.z]) - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534] - Resolves: RHEL-164534 (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z]) - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - Enable building for ppc64le - Don't remove slof.bin for ppc64le - usb: add config options for hub and hid devices for ppc - Remove pnv_chip_find_core calls from SPRD helpers - Remove pre-3.0 migration from spapr_compat_rhel7_6 - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948] - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174] - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174] - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174] - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174] - Resolves: RHEL-155947 (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8]) - Resolves: RHEL-155948 (Mirror job can miss writes during startup, corrupting the copy [rhel-9]) - Resolves: RHEL-154174 (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8]) - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679] - Resolves: RHEL-151679 ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting) - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396] - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396] - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396] - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396] - Resolves: RHEL-149396 (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9]) - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115] - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115] - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115] - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115] - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115] - Resolves: RHEL-67115 ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6]) - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422] - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620] - Resolves: RHEL-147422 (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts) - Resolves: RHEL-130620 (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9]) - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989] - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989] - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989] - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989] - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187] - kvm-q35-increase-default-tseg-size.patch [RHEL-139057] - Resolves: RHEL-132989 (Expose block limits of block nodes in QMP and qemu-img [rhel-9]) - Resolves: RHEL-140187 (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8]) - Resolves: RHEL-139057 ([qemu, rhel-9] increase default TSEG size) - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240] - Resolves: RHEL-138240 (QEMU crashes when stopping source VM during live migration [rhel-9]) - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193] - Resolves: RHEL-132193 ([rhel 9.8]L1VH qemu downstream initial merge RHEL9) - kvm-pcie_sriov-make-pcie_sriov_pf_exit-safe-on-non-SR-IO.patch [RHEL-131144] - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-132193] - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-132193] - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-132193] - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-132193] - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-132193] - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-132193] - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-132193] - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-132193] - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-132193] - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-132193] - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-132193] - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-132193] - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-132193] - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-132193] - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-132193] - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-132193] - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-132193] - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-132193] - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-132193] - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-132193] - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-132193] - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-132193] - kvm-docs-Add-mshv-to-documentation.patch [RHEL-132193] - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-132193] - kvm-accel-mshv-initialize-thread-name.patch [RHEL-132193] - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-132193] - Resolves: RHEL-131144 (qemu crash after hot-unplug disk from the multifunction enabled bus [RHEL.9.8]) - Resolves: RHEL-132193 ([rhel 9.8]L1VH qemu downstream initial merge RHEL9) - Release bump to enable added gating.yaml - Resolves: RHEL-5625 - Compile libqhullcpp with -fPIC - Resolves: RHEL-5625 - 2157765 - Ship qpdf-devel in CRB - 2106940 - FIPS breaks pdftopdf and bannertopdf - 2095993 - Move qpdf to CRB repository - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - 1950033 - Possible changes in zlib output causes FTBFS for qpdf - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 1937988 - qpdf-10.3.1 is available - 1935799 - qpdf-10.3.0 is available - 1932052 - qpdf-10.2.0 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Assimp: Fix heap-based overflow in Q3DLoader::InternReadFile Resolves: RHEL-120985 - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup Resolves: RHEL-104999 - Assimp: Fix heap-based overflow in Assimp::ASE::Parser::ParseLV4MeshBonesVertices Resolves: RHEL-105004 - qt5: QtCore Assertion Failure Denial of Service Resolves: RHEL-96231 - HTTP2: Delay any communication until encrypted() can be responded to Resolves: RHEL-46351 - Fix CVE-2024-25580: potential buffer overflow when reading KTX images Resolves: RHEL-25726 - Fix incorrect integer overflow check in HTTP2 implementation Resolves: RHEL-20239 - Fix infinite loops in QXmlStreamReader (CVE-2023-38197) Resolves: bz#2222771 - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName() Resolves: RHEL-247216 - qt5: QtCore Assertion Failure Denial of Service Resolves: RHEL-96231 - Fix CVE-2026-19248: unbounded recursion and O(N²) behavior in QDom Resolves: RHEL-261136 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277670 - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName() Resolves: RHEL-247216 - qt5: QtCore Assertion Failure Denial of Service Resolves: RHEL-96231 - 5.15.9 Resolves: bz#2175726 - 5.15.3 Resolves: bz#2061353 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild (elfutils#2188064) Resolves: bz#2175730 - 5.15.9 Resolves: bz#2175730 - 5.15.3 Resolves: bz#2061357 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968461 - Rebuild (elfutils#2188064) Resolves: bz#2175728 - Disable tests failing in gating Resolves: bz#2175728 - 5.15.9 + sync with Fedora Resolves: bz#2178624 Resolves: bz#2175728 - 5.15.3 + sync with Fedora Resolves: bz#2061355 - Sync with Fedora Resolves: bz#2025420 - Sync with Fedora: - sync kde/5.15 branch fixes - pull in candidate fix QTBUG-83890 Resolves: bz#1988934 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Let qt5_install_tests macro handle mangling python shebangs Resolves: bz#1968462 - Add gating tests Resolves: bz#1968462 - 5.15.9 Resolves: bz#2175733 - 5.15.3 Resolves: bz#2061359 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968464 - 5.15.9 Resolves: bz#2175734 - 5.15.3 Resolves: bz#2061360 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968465 - 5.15.9 Resolves: bz#2175735 - 5.15.3 Resolves: bz#2061361 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Add gating tests Resolves: bz#1968466 - 5.15.9 Resolves: bz#2175736 - 5.15.3 Resolves: bz#2061361 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Let qt5_install_tests macro handle mangling python shebangs Resolves: bz#1968467 - Add gating tests Resolves: bz#1968467 - 5.15.9 Resolves: bz#2175737 - 5.15.3 Resolves: bz#2061363 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968468 - 5.15.9 Resolves: bz#2175738 - 5.15.3 Resolves: bz#2061364 - Rebuild (move -devel subpkg to AppStream) Resolves: bz#2028779 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968469 - 5.15.9 Resolves: bz#2175745 - 5.15.3 Resolves: bz#2061365 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968470 - 5.15.9 Resolves: bz#2175739 - 5.15.3 Resolves: bz#2061366 - Sync with Fedora - add recommends: iio-sensor-proxy Resolves: bz#1971438 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968471 - 5.15.9 Resolves: bz#2175740 - 5.15.3 Resolves: bz#2061367 - Rebuild to include -devel subpkg in AppStream Resolves: bz#2028567 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Properly build unit tests Resolves: bz#1968472 - Add gating tests Resolves: bz#1968472 - 5.15.9 Resolves: bz#2175741 - 5.15.3 Resolves: bz#2061368 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968473 - Fix uninitialized variable usage in m_unitsPerEm (CVE-2023-32573) Resolves: bz#2208140 - 5.15.9 Resolves: bz#2175742 - 5.15.3 Resolves: bz#2061369 - Fix out-of-bound write that may lead to DoS Resolves: bz#2038488 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968474 - Rebuild (LLVM-21) Resolves: RHEL-108348 - Rebuild (LLVM-20) Resolves: RHEL-81777 - Rebuild (LLVM-19) Resolves: RHEL-66115 - Rebuild (LLVM-18) Resolves: RHEL-28681 - 5.15.9 Resolves: bz#2175746 - 5.15.3 Resolves: bz#2061372 - Sync with Fedora Resolves: bz#2051384 - Sync with Fedora Resolves: bz#2044169 - Sync with Fedora Resolves: bz#2028778 - Drop BR: tree Resolves: bz#2014080 - Sync with Fedora Resolves: bz#2012714 - Sync with Fedora Resolves: bz#2003935 - Client: expose toplevel window state (change from Qt6) Resolves: bz#1968292 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - 5.15.9 Resolves: bz#2175747 - 5.15.3 Resolves: bz#2061373 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968478 - Move QML imports out of -devel subpackage Resolves: bz#2175749 - 5.15.9 Resolves: bz#2175749 - 5.15.3 Resolves: bz#2061374 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968479 - 5.15.9 Resolves: bz#2175750 - 5.15.3 Resolves: bz#2061375 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968481 - Rebuild (elfutils#2188064) Resolves: bz#2175751 - 5.15.9 Resolves: bz#2175751 - 5.15.3 Resolves: bz#2061376 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add gating tests Resolves: bz#1968480 - Rebuilt for CRB inclusion Resolves: RHEL-135108 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop fmt-devel from build requires - Apply fmt-header-only patches - Update licence field - Drop unnecessary dependencies - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebase to 16.2.4 - Add libcephsqlite packages - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - libblk.so -> libblk.a - remove python3-rgw from ceph-common deps - disable multiple build options - disable multiple packages - remove unnecessary files - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13 - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove gtest dependency and turn off tests Resolves: #1977656 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add patch for C++20 support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Install pkg-config and cmake files to arched location - Build documentation as noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove gtest dependency and turn off tests Resolves: #1977656 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add patch for C++20 support - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Install pkg-config and cmake files to arched location - Build documentation as noarch - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebase to readline-8.1 Resolves: #1904867 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Use make macros https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - migrated to SPDX license - allow multiple names and _srv_ ad_server option Resolves: jira#RHEL-12112 - fix ccache handling for leave operation Resolves: jira#RHEL-5104 - Update to upstream release 0.17.1 Resolves: rhbz#2129050, rhbz#2133839 - Do not generate debug packages Resolves: RHEL-70582 - Rebuild Resolves: RHEL-70582 - Add an rpminspect.yaml file to turn-off debuginfo testing Resolves: RHEL-70582 - remove strip of realtime-entsk and generate debuginfo - ensure all files have valid SPDX license identifiers - remove Red Hat Makefile targets and specfile - Makefile cleanups and added .gitignore - drop the 'v' in the version string for the tarball - Makefile: add options for passing annocheck - Bump version to 2.5 Resolves: RHEL-30179 - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove things that we don't ship - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Remove unnecessary redhat_lsb_trigger.* programs (#1964367) - Do not call non-existing lsn program on glibc updates - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use macros when invoking for invoking make and gcc - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update Java source/target to 1.8 - Install license files in licensedir instead of docdir - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Remove maven-javadoc-plugin dependency - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Allow building against Java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Remove maven-javadoc-plugin dependency - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Allow building against Java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Recommends: cpp for xrdb (#1954350) - Prune obsolete/unused utilities (#1954355) - Clean up the .gitignore file - Drop mcpp from xrdb (#1954350) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Provide xisxwayland like all other utilities - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add BuildRequires for make - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - xisxwayland 1 - Initial version. - Initial version. - Initial version. - Backport https://github.com/coreos/rpm-ostree/pull/5558 Resolves: RHEL-147222 - Revert conditional change for ostree_ext Resolves: RHEL-144611 - Rebase to 2026.1 Resolves: RHEL-143217 Resolves: RHEL-143210 - Rebase to 2025.11 Resolves: #RHEL-113381 - Rebase to 2025.10 Resolves: #RHEL-106848 - Rebase to 2025.9 Resolves: #RHEL-103135 - Move `ostree container` to bootc Resolves: #RHEL-72863 - Rebase to 2025.8 Resolves: #RHEL-90254 - Backport https://github.com/coreos/rpm-ostree/pull/5351 Resolves: #RHEL-85684 - Rebase to 2025.7 Resolves: #RHEL-85392 - Backport: https://github.com/coreos/rpm-ostree/pull/5575 Resolves: RHEL-154807 - Rebuilt for RHEL 9.8 Resolves: RHEL-154807 - Backport https://github.com/coreos/rpm-ostree/pull/5569 Resolves: RHEL-154808 - Backport https://github.com/coreos/rpm-ostree/pull/5558 Resolves: RHEL-147222 - Revert conditional change for ostree_ext Resolves: RHEL-144611 - Rebase to 2026.1 Resolves: RHEL-143217 Resolves: RHEL-143210 - Rebase to 2025.11 Resolves: #RHEL-113381 - Rebase to 2025.10 Resolves: #RHEL-106848 - Rebase to 2025.9 Resolves: #RHEL-103135 - Move `ostree container` to bootc Resolves: #RHEL-72863 - Improve error handling on keystore load (RHEL-114837) - Sort files before passing to file attr dependency generators (RHEL-95376) - Allow an optional "override clock" for deterministic timestamps (RHEL-106672) - Add support for spec local file attributes and generators (RHEL-52772) - Store configurable digest(s) on packages in rpmdb (RHEL-35619) - Fix a hard link race condition in brp-strip (RHEL-74011) - Allow parametric macros to opt out of option processing (RHEL-67161) - Report unsafe symlinks during installation as a specific case (RHEL-33393) - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070) - Improve newly added %patch warning/error messages (RHEL-6294) - Fix %patch N applying Patch0 implicitly (RHEL-6294) - Issue deprecation warning for number-less %patch (RHEL-6294) - Fix discarded const qualifier in previous patch (RHEL-22607) - Fix root relocation regression (RHEL-28967) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Revert incorrect fix for false array overrun (RHEL-22607) - Fix potential use of uninitialized pipe array (RHEL-22604) - Fix potential use of uninitialized pgp struct (RHEL-22605) - Don't confuse OpenScanHub with false array overrun (RHEL-22607) - Add SourceLicense tag to spec syntax (RHEL-28798) - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895) - Rebase to upstream rteval-3.10 Resolves: RHEL-82914, RHEL-111000, RHEL-114928 - Make timerlat the default measurement module - Make the default interval 100us Resolves: RHEL-97540 - Fix syntax warning when using python >=3.12 Resolves: RHEL-97825 - Make the default interval for timerlat in rteval 1100us - Make cyclictest the default measurement module for rteval Resolves: RHEL-78394 - Fix missing system statistics Resolves: RHEL-70166 - Rebase to upstream rteval-v3.9 Resolves: RHEL-63519 - Update the kcompile kernel to linux-6.12-rc4 Resolves: RHEL-63621 - Collect tuned state in sysinfo Resolves: RHEL-33303 - Add functionality to allow user to execute cpupower tool to set idle state depth while running rteval. - Disable latency trick by using --default-system option with cyclictest when setting idle state depth. Resolves: RHEL-37645 - Prevent using cyclictest and timerlat and the same time - Add a --noload option - Switch to autosetup, picking up the updates that should have been in 3.8-4 Resolves: RHEL-35506 Resolves: RHEL-50323 - Rebuid in a side tag in order to sync with rteval Resolves: RHEL-86701 - Changed the kernel version to 6.17.7 - changed the rteval-loads number scheme to reflect the kernel version Resolves: RHEL-86701 - Rebuild to go through gating Resolves: RHEL-67848 - Upgrade the kernel to linux-6.12-rc4 Resolves: RHEL-63614 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Some static analysis fixes for unitialized structs Resolves: RHEL-25498 - Fix a memory leak in parse_package() of repo conda (RHEL-25496) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178982) - Backport "choice rules: also do solver_choicerulecheck for package downgrades" Resolves: RHEL-141449 - Backport "Implement color filtering when adding update targets" Resolves: RHEL-103995 - Update to abrt 0.4.0. Resolves: rhbz#1842476 - Execute test suite unconditionally. - Upload correct sources. - Update to abrt 0.4.0. Resolves: rhbz#1842476 - Execute test suite unconditionally. - Upload correct sources. - Update to abrt 0.4.0. Resolves: rhbz#1842476 - Execute test suite unconditionally. - Upload correct sources. - Update to abrt 0.4.0. Resolves: rhbz#1842476 - Execute test suite unconditionally. - Upload correct sources. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Enable test suite. Resolves: rhbz#1970776 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to asciidoctor 2.0.12. Resolves: rhbz#1893940 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Replace build time Erubis dependency by Erubi. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to Asciidoctor 2.0.10 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Enable test suite. Resolves: rhbz#1970776 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to asciidoctor 2.0.12. Resolves: rhbz#1893940 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Replace build time Erubis dependency by Erubi. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to Asciidoctor 2.0.10 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Conditionaly disable `BR: rubygem(shoulda-context)`. Resolves: rhbz#1937981 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - update to new version Resolves: rhbz#1842013 Resolves: rhbz#1923366 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Conditionaly disable `BR: rubygem(shoulda-context)`. Resolves: rhbz#1937981 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - update to new version Resolves: rhbz#1842013 Resolves: rhbz#1923366 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop `tidy` dependency. Related: rhbz#1951246 - Drop Latex test cases and disable stringex dependency. Resolves: rhbz#1951246 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 2.3.1 - Apply upstream fix for CVE-2021-28834 (rouge formatter namespace restriction) - Use recent packaging style - 2.3.0 - Speficy rouge version dependency for test suite - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Wrap rexml depedency with fedora release - Add upstream patch for rouge change - Add upstream patch to silence warnings from minitest - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Drop `tidy` dependency. Related: rhbz#1951246 - Drop Latex test cases and disable stringex dependency. Resolves: rhbz#1951246 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 2.3.1 - Apply upstream fix for CVE-2021-28834 (rouge formatter namespace restriction) - Use recent packaging style - 2.3.0 - Speficy rouge version dependency for test suite - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Wrap rexml depedency with fedora release - Add upstream patch for rouge change - Add upstream patch to silence warnings from minitest - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Bump and rebuild after unretiring the package. Related: rhbz#1943532 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Include upstream patch to make test suite compatible with kramdown 2.2.0. - Fixes RHBZ#1865414 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Initial package - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Bump and rebuild after unretiring the package. Related: rhbz#1943532 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Include upstream patch to make test suite compatible with kramdown 2.2.0. - Fixes RHBZ#1865414 - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Initial package - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to Mustache 1.1.1. Resolves: rhbz#1321203 Resolves: rhbz#1800018 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to Mustache 1.1.1. Resolves: rhbz#1321203 Resolves: rhbz#1800018 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix test suite compatibility with libxml 2.9.12. Resolves: rhbz#1980885 - Remove rubygem(minitest-reporters) dependency. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 1.11.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 1.11.1 - F-34: rebuild against ruby 3.0 - 1.11.0 - 1.11.0.rc4 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fix test suite compatibility with libxml 2.9.12. Resolves: rhbz#1980885 - Remove rubygem(minitest-reporters) dependency. - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 1.11.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 1.11.1 - F-34: rebuild against ruby 3.0 - 1.11.0 - 1.11.0.rc4 - Support added for post-quantum cryptography Resolves: RHEL-127516 - Fix bogus 'sscg' arguments Related: RHEL-118292 - Update to openwsman-2.8.1 Resolves: RHEL-97643 - Add libwsman-client.so.4 for backward compatibility Related: RHEL-97643 - Update OpenSSL certificates set up Resolves: RHEL-118292 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 1.5.2 - 1.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 1.5.0 - racc2y, y2racc removed - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - F-32: rebuild against ruby27 - 1.4.16 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 1.5.2 - 1.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 1.5.0 - racc2y, y2racc removed - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - F-32: rebuild against ruby27 - 1.4.16 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add BRs for tests, enable tests in %check. - Require /usr/bin/groff, not the package in case the file is moved. - Keep the license file in the original location. - Adjust various macros and invocations. - Switch to https://github.com/apjanke/ronn-ng/ upstream fork (#1817168) - Regenerate spec file with gem2rpm. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add BRs for tests, enable tests in %check. - Require /usr/bin/groff, not the package in case the file is moved. - Keep the license file in the original location. - Adjust various macros and invocations. - Switch to https://github.com/apjanke/ronn-ng/ upstream fork (#1817168) - Regenerate spec file with gem2rpm. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 3.26.0. - Update to version 3.25.0. - Update to version 3.24.0. - Update to version 3.23.0. - Update to version 3.22.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 3.21.0. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to version 3.26.0. - Update to version 3.25.0. - Update to version 3.24.0. - Update to version 3.23.0. - Update to version 3.22.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to version 3.21.0. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Re-add Requires: rubygem(rake), as it's needed for runtime. Resolves: rhbz#1982410 Resolves: rhbz#1982419 - Disable integration test suite to cut down the dependency tree. Resolves: rhbz#1952842 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Make test suite green. - Add conditional for eln - rr 1.2.1: Disable failing cucumber suite for now - Ruby 3.0: Disable failing cucumber suite for now - 3.10.1 - Enable tests again - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 3.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 3.9.0 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 3.10.1 - Enable tests again - 3.10.0 - Once disable test for bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 3.9.2 - 3.9.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 3.10.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 3.10.1 - Enable tests again - 3.10.0 - Once disable test for bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - 3.9.1 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - 3.10.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 3.10.1 - Enable tests again - 3.10.0 - Once disable test for bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 3.9.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Band-aid clap pre-release version - Update to 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Update to 15 - Update to 14 - Use 'cargo install --no-track' with cargo 1.41 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuild against json-c-0.14-11 Related: rhbz#2023326 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - New upstream version - lib: Use GLib for computing SHA-1 digests - sr_distances_cluster_objects: Check arg safety - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream version - Fix builds with python3.10 - Add fix for https://bugzilla.redhat.com/show_bug.cgi?id=1898063 - New upstream version - Fix leaks in koops stacktrace- and report-handling code - Replace utility code with GLib functions - Fix unit test portability issue - Add build dependency on make - Remove #define PyString_AsString PyUnicode_AsUTF8 - python: Adapt to changes made in PEP 590 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - rebase to upstream v1.5.2 - convert license naming to SPDX - make static analysis happy with a few checks & rearanges with dynamic-memory-management Resolves: rhbz#2168579 - Be a bit more descriptive on issues opening watchdog-devices Resolves: rhbz#2108122 - obviously autoconf is defining runstatedir - but with a wrong default - directly hand it over to configure and skip --with-runstatedir implemented in configure.ac for older versions of autoconf Resolves: rhbz#2011707 - rebase to upstream v1.5.1 Resolves: rhbz#2013261 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - properly conflict with pacemaker not providing sync-default we need Resolves: rhbz#1979961 Resolves: rhbz#1979573 - sync with fedora sbd-1.5.0-1 Resolves: rhbz#1979961 Resolves: rhbz#1979573 - Add support for Image Mode Resolves: RHEL-132483 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix possible null pointer dereferences after strstr calls - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix getting of InstallDate property, improve it to work on non en_US locales and update support for recent Fedora distributions - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros, patch by Tom Stellard <tstellar@redhat.com> - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - fix build with GCC 13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - fix build with OpenSSL 3.0.0 (fixes rhbz#2021909) - Rebuilt with OpenSSL 3.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - don't ignore errors from sbkeysync (fixes rhbz#1955828) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Add AlmaLinux 9 support - Fix inconsistent and missing audit keys in some audit rules (RHEL-141394) - Modify shipped kickstart files so that the size of boot partition aligns with official recommended size (RHEL-145201) - Disable SHA-1 for the RPM component in RHEL 9 CIS profiles (RHEL-138448) - Use correct permissions and consider the log_group option in rules file_permissions_var_log_audit and directory_permissions_var_log_audit (RHEL-138549) - Rule configure_ssh_crypto_policy has been removed from RHEL 9 and RHEL 10 profiles. (RHEL-65737) - Rules of type sshd_use_strong_kex have been removed from RHEL CIS profiles in favor of system wide crypto policies usage. (RHEL-62941) - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-136121) - Update to the latest upstream release (RHEL-135773) - rebase scap-security-guide package to version 0.1.78 (RHEL-118557) - fix incorrect applicability of Grub2 UEFI specific rules - replace grub-mkconfig with grub2-mkconfig in rule descriptions - Turn on SCE for this release (RHEL-94803) - Rebase to scap-security-guide version 0.1.77 (RHEL-94803) - rule networkmanager_dns_mode now checks dropin files and has more resilient regex (RHEL-62843) - rsyslog_remote_loghost checks for Rainer Script syntax as well (RHEL-62731) - improve checking of Grub2 superuser and password configuration (RHEL-58818) - rebase scap-security-guide to the latest upstream version 0.1.76 (RHEL-74240) - modify the rule require_singleuser_auth to honor overriding mechanism offered by Systemd (RHEL-71936) - make the rule sysctl_user_max_user_namespaces informational and unscored in RHEL 9 STIG profile (RHEL-40120) - align checking of approved SSH ciphers with latest STIG policy (RHEL-65432) - Rebase to new release (RHEL-66154) - the rule sshd_use_priv_separation is no longer used (RHEL-66057) - add a rule checking for presence of chrony to CIS RHEL 9 profile (RHEL-60005) - remediation of Networkmanager DNS mode now remediates value "default" (RHEL-53426) - Adjust mount_option_nodev_nonroot_local_partitions to work in Image Builder environments. (RHEL-45018) - Adjusted rules related to sshd ensure constancy in checked values and ensure that drop in configuration files are checked. (RHEL-38206) - Rebase to a new upstream release 0.1.74 (RHEL-53865) - Ensure authselect features are preserved by enable_authselect rule (RHEL-39383) - Fix check for passwords last changed date (RHEL-47129) - Remediations of Journald configuration files now include a correct section (RHEL-38531) - Adjust service requirements for CIS profiles (RHEL-23852) - Update password hashing settings for ANSSI-BP-028 (RHEL-44983) - Add AlmaLinux 9 support - Fix inconsistent and missing audit keys in some audit rules (RHEL-141394) - Modify shipped kickstart files so that the size of boot partition aligns with official recommended size (RHEL-145201) - Disable SHA-1 for the RPM component in RHEL 9 CIS profiles (RHEL-138448) - Use correct permissions and consider the log_group option in rules file_permissions_var_log_audit and directory_permissions_var_log_audit (RHEL-138549) - Rule configure_ssh_crypto_policy has been removed from RHEL 9 and RHEL 10 profiles. (RHEL-65737) - Rules of type sshd_use_strong_kex have been removed from RHEL CIS profiles in favor of system wide crypto policies usage. (RHEL-62941) - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-136121) - Update to the latest upstream release (RHEL-135773) - rebase scap-security-guide package to version 0.1.78 (RHEL-118557) - fix incorrect applicability of Grub2 UEFI specific rules - replace grub-mkconfig with grub2-mkconfig in rule descriptions - Turn on SCE for this release (RHEL-94803) - Rebase to scap-security-guide version 0.1.77 (RHEL-94803) - rule networkmanager_dns_mode now checks dropin files and has more resilient regex (RHEL-62843) - rsyslog_remote_loghost checks for Rainer Script syntax as well (RHEL-62731) - improve checking of Grub2 superuser and password configuration (RHEL-58818) - rebase scap-security-guide to the latest upstream version 0.1.76 (RHEL-74240) - modify the rule require_singleuser_auth to honor overriding mechanism offered by Systemd (RHEL-71936) - make the rule sysctl_user_max_user_namespaces informational and unscored in RHEL 9 STIG profile (RHEL-40120) - align checking of approved SSH ciphers with latest STIG policy (RHEL-65432) - Rebase to new release (RHEL-66154) - the rule sshd_use_priv_separation is no longer used (RHEL-66057) - add a rule checking for presence of chrony to CIS RHEL 9 profile (RHEL-60005) - remediation of Networkmanager DNS mode now remediates value "default" (RHEL-53426) - Adjust mount_option_nodev_nonroot_local_partitions to work in Image Builder environments. (RHEL-45018) - Adjusted rules related to sshd ensure constancy in checked values and ensure that drop in configuration files are checked. (RHEL-38206) - Rebase to a new upstream release 0.1.74 (RHEL-53865) - Ensure authselect features are preserved by enable_authselect rule (RHEL-39383) - Fix check for passwords last changed date (RHEL-47129) - Remediations of Journald configuration files now include a correct section (RHEL-38531) - Adjust service requirements for CIS profiles (RHEL-23852) - Update password hashing settings for ANSSI-BP-028 (RHEL-44983) - Add AlmaLinux 9 support - rule rsyslog_remote_access_monitoring handles Rainer syntax objects as case insensitive (RHEL-171951) - Fixed remediation problems occurring when authselect profiles contain multiple authselect features (RHEL-165050) - Rebase scap-security-guide to 0.1.81 (RHEL-180787) - Fix inconsistent and missing audit keys in some audit rules (RHEL-141394) - Modify shipped kickstart files so that the size of boot partition aligns with official recommended size (RHEL-145201) - Disable SHA-1 for the RPM component in RHEL 9 CIS profiles (RHEL-138448) - Use correct permissions and consider the log_group option in rules file_permissions_var_log_audit and directory_permissions_var_log_audit (RHEL-138549) - Rule configure_ssh_crypto_policy has been removed from RHEL 9 and RHEL 10 profiles. (RHEL-65737) - Rules of type sshd_use_strong_kex have been removed from RHEL CIS profiles in favor of system wide crypto policies usage. (RHEL-62941) - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-136121) - Update to the latest upstream release (RHEL-135773) - rebase scap-security-guide package to version 0.1.78 (RHEL-118557) - fix incorrect applicability of Grub2 UEFI specific rules - replace grub-mkconfig with grub2-mkconfig in rule descriptions - Turn on SCE for this release (RHEL-94803) - Rebase to scap-security-guide version 0.1.77 (RHEL-94803) - rule networkmanager_dns_mode now checks dropin files and has more resilient regex (RHEL-62843) - rsyslog_remote_loghost checks for Rainer Script syntax as well (RHEL-62731) - improve checking of Grub2 superuser and password configuration (RHEL-58818) - rebase scap-security-guide to the latest upstream version 0.1.76 (RHEL-74240) - modify the rule require_singleuser_auth to honor overriding mechanism offered by Systemd (RHEL-71936) - make the rule sysctl_user_max_user_namespaces informational and unscored in RHEL 9 STIG profile (RHEL-40120) - align checking of approved SSH ciphers with latest STIG policy (RHEL-65432) - Rebase to new release (RHEL-66154) - the rule sshd_use_priv_separation is no longer used (RHEL-66057) - add a rule checking for presence of chrony to CIS RHEL 9 profile (RHEL-60005) - remediation of Networkmanager DNS mode now remediates value "default" (RHEL-53426) - Adjust mount_option_nodev_nonroot_local_partitions to work in Image Builder environments. (RHEL-45018) - Adjusted rules related to sshd ensure constancy in checked values and ensure that drop in configuration files are checked. (RHEL-38206) - Add AlmaLinux 9 support - Resolve dropped changelog entry - Rebase scap-security-guide to 0.1.82 in RHEL 9.8.z (RHEL-242528) - Add rule ensure_journald_and_rsyslog_not_active_together to RHEL 9 CIS profiles (RHEL-181671) - Add rule crypto_policy_not_overridden to RHEL 9 STIG profile (RHEL-104411) - rule rsyslog_remote_access_monitoring handles Rainer syntax objects as case insensitive (RHEL-171951) - Fixed remediation problems occurring when authselect profiles contain multiple authselect features (RHEL-165050) - Rebase scap-security-guide to 0.1.81 (RHEL-180787) - Fix inconsistent and missing audit keys in some audit rules (RHEL-141394) - Modify shipped kickstart files so that the size of boot partition aligns with official recommended size (RHEL-145201) - Disable SHA-1 for the RPM component in RHEL 9 CIS profiles (RHEL-138448) - Use correct permissions and consider the log_group option in rules file_permissions_var_log_audit and directory_permissions_var_log_audit (RHEL-138549) - Rule configure_ssh_crypto_policy has been removed from RHEL 9 and RHEL 10 profiles. (RHEL-65737) - Rules of type sshd_use_strong_kex have been removed from RHEL CIS profiles in favor of system wide crypto policies usage. (RHEL-62941) - Rebase scap-security-guide to the latest upstream version 0.1.80 (RHEL-136121) - Update to the latest upstream release (RHEL-135773) - rebase scap-security-guide package to version 0.1.78 (RHEL-118557) - fix incorrect applicability of Grub2 UEFI specific rules - replace grub-mkconfig with grub2-mkconfig in rule descriptions - Turn on SCE for this release (RHEL-94803) - Rebase to scap-security-guide version 0.1.77 (RHEL-94803) - rule networkmanager_dns_mode now checks dropin files and has more resilient regex (RHEL-62843) - rsyslog_remote_loghost checks for Rainer Script syntax as well (RHEL-62731) - improve checking of Grub2 superuser and password configuration (RHEL-58818) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - drop WITH_SELINUX knob and selinux patches, there's built-in support now - drop several patches which were incorporated upstream, except for changewarnSegv patch (did not apply, and not needed nowadays) - Initial commit of secvarctl on c9s - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-209599 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-209599 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Rebuild with the target::exception flag Resolves: RHEL-148247 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148247 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146688 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128542 - Add the fs_write_tmpfs_files() interface Resolves: RHEL-142141 - Dontaudit aide the execmem permission Resolves: RHEL-121480 - Update gpg policy for interactions with rhc-playbook-verifier Resolves: RHEL-132748 - Allow rhc_playbook_verifier_t stream connect to itself Resolves: RHEL-132748 - Update policy for rhc-worker-playbook Resolves: RHEL-132748 - Allow traceroute_t bind rawip sockets to unreserved ports Resolves: RHEL-130267 - Revert "Allow traceroute_t bind rawip sockets to unreserved ports" Related: RHEL-130267 - Allow sudodomain connect to gkeyringd over a unix stream socket Resolves: RHEL-121158 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-95985 - Allow ssh_agent_type manage generic cache home files Resolves: RHEL-121165 - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t Resolves: RHEL-121165 - Allow boothd connect to systemd-machined over a unix socket Resolves: RHEL-140882 - Macros: Require only "stable" version of selinux-policy (RHEL-141433) - Add insights_client service interfaces Related: RHEL-140893 - Confine rhc-worker-playbook.worker and rhc-playbook-verifier Resolves: RHEL-132748 - Allow gpg manage rpm cache Related: RHEL-108775 - Allow gpg read rpm cache Related: RHEL-108775 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121480 - Allow rules for confined users logged in plasma Resolves: RHEL-133898 - Allow login_userdomain watch lnk_files in /usr Resolves: RHEL-133898 - Revert "Allow NM nvme dispatcher script start systemd services" Resolves: RHEL-111946 - Allow ssh_agent_type create a sockfile in /run/user/USERID Resolves: RHEL-121936 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-111946 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121480 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129879 - Add the rpm_signal() interface Related: RHEL-108826 - Allow tuned_t use its private tmpfs files Related: RHEL-108826 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-66119 - Allow sysadm access to TPM Resolves: RHEL-119055 - Update policy for dhcpc_hook_t Resolves: RHEL-113941 - Allow stap server read virtual memory sysctls Resolves: RHEL-114157 - Allow login_userdomain watch /home and /var directories Resolves: RHEL-119686 - Allow login_userdomain read lastlog Resolves: RHEL-119686 - Allow staff role read/write cockpit-session unix stream sockets Resolves: RHEL-108068 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113941 - Allow insights-client manage /etc symlinks Resolves: RHEL-108826 - Allow insights-client get attributes of the rpm executable Resolves: RHEL-127329 - Allow ras-mc-ctl get attributes of the kmod executable Resolves: RHEL-103975 - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern Resolves: RHEL-101155 - Allow bootupd delete symlinks in the /boot directory Resolves: RHEL-101155 - Update policy for bootupd Resolves: RHEL-101155 - Allow create kerberos files in postgresql db home Resolves: RHEL-123225 - Initial import - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add epoch to rpm spec file for RHEL-based releases. - Sync with mpath_valid changes. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Initial release. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add epoch to rpm spec file for RHEL-based releases. - Sync with mpath_valid changes. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Initial release. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add epoch to rpm spec file for RHEL-based releases. - Sync with mpath_valid changes. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Initial release. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add epoch to rpm spec file for RHEL-based releases. - Sync with mpath_valid changes. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Initial release. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Add py_ssize_t_clean module support for compatibility with python-qt5 Resolves: RHEL-27554 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 0.3.5 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix obsoletes on removed subpackages - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 0.9.0.M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Add plexus-container-default alias - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 0.3.5 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Fix obsoletes on removed subpackages - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 0.3.5 - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Update to upstream version 0.9.0.M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Add plexus-container-default alias - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update javapackages test plan to f42 - Update to upstream version 0.9.0.M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Add plexus-container-default alias - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update javapackages test plan to f42 - Update to upstream version 0.9.0.M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Add plexus-container-default alias - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update javapackages test plan to f42 - Update to upstream version 0.9.0.M3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Add plexus-container-default alias - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Update to version 0.3.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 0.3.5 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Remove unnecessary dependency on parent POM. - Update to version 0.3.4. - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Update to upstream version 0.3.5 - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 1.7.32 - Enable slf4j-migrator and log4j-over-slf4j modules - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Disable unused log4j12 module. - Port to commons-lang3. - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Update javapackages test plan to f42 - Rebuild to regenerate auto-requires - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 1.7.36 - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Use systemd-sysusers Resolves: RHEL-76028 - Revert SPDX license change as RHEL 9 does not use it - Prevent access to global C++ variables once they destroyed - Patch from Neil Horman (OpenSSL) - Run p11test tests individually - Resolves: rhbz#2261703 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - drop WITH_SELINUX knob and selinux patches, there's built-in support now - drop several patches which were incorporated upstream, except for changewarnSegv patch (did not apply, and not needed nowadays) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.10.2 - Fix crash with python 3.9 (#1878276) - Update to 0.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Fixed FTBFS - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.10.2 - Fix crash with python 3.9 (#1878276) - Update to 0.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Fixed FTBFS - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.10.2 - Fix crash with python 3.9 (#1878276) - Update to 0.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Fixed FTBFS - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Link with -Wl,-z,now Resolves: rhbz#2044891 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Fix building with the latest GCC. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Link with -Wl,-z,now Resolves: rhbz#2044891 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Fix building with the latest GCC. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Link with -Wl,-z,now Resolves: rhbz#2044891 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Fix building with the latest GCC. - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - CVE-2020-23903 speex: divide by zero in read_samples() via crafted WAV file - Resolves: CVE-2020-23903 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Fixes CVE-2026-11822 - Resolves: RHEL-218273 - Fixes CVE-2026-11824 - Resolves: RHEL-218281 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Fixes CVE-2026-11822 - Resolves: RHEL-218273 - Fixes CVE-2026-11824 - Resolves: RHEL-218281 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Fixes CVE-2026-11822 - Resolves: RHEL-218273 - Fixes CVE-2026-11824 - Resolves: RHEL-218281 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Fixes CVE-2026-11822 - Resolves: RHEL-218273 - Fixes CVE-2026-11824 - Resolves: RHEL-218281 - Enable sqlite3_deserialize and sqlite3_serialize interfaces - Resolves: RHEL-155950 - Fixes CVE-2025-6965 - Enabled sqlite-session feature - Resolves: RHEL-89962 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - new upstream release - drop WITH_SELINUX knob and selinux patches, there's built-in support now - drop several patches which were incorporated upstream, except for changewarnSegv patch (did not apply, and not needed nowadays) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - 2.0.2-8 - Fix this spec file to build for F33+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - 2.0.2-6 🐞 Workaround Fedora problems created by rpm commit 93604e2 - 2.0.2-5 💥 Actually rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.0.2-4 👻 Rebuild with fonts-rpm-macros 2.0.4 to make sure fontconfig files are valid - 2.0.2-3 ✅ Lint, lint, lint and lint again - 2.0.2-2 ✅ Rebuild with fonts-rpm-macros 2.0.2 - mod_dav_svn: add conflicts to ensure compatible mod_dav Related: RHEL-79948 - mod_dav_svn: inherit DavBasePath from httpd Resolves: RHEL-79948 - mod_dav_svn: add conflicts to ensure compatible mod_dav Related: RHEL-79948 - mod_dav_svn: inherit DavBasePath from httpd Resolves: RHEL-79948 - CVE-2026-82474 sudo: execveat(2) intercept/log_subcmds bypass Resolves: RHEL-255647 - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHEL-128623 - sudo passes SHELL environment variable twice to the shell being executed [rhel-9] Resolves: RHEL-127359 RHEL: 9.7.0 ERRATUM - sudo missing spacing and separator in log when using "--preserve-env=list" Resolves: RHEL-71916 - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100020 - CVE-2026-96512 sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization [rhel-9.8.z] Resolves: RHEL-267328 - CVE-2026-82474 sudo: execveat(2) intercept/log_subcmds bypass Resolves: RHEL-255647 - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHEL-128623 - sudo passes SHELL environment variable twice to the shell being executed [rhel-9] Resolves: RHEL-127359 RHEL: 9.7.0 ERRATUM - sudo missing spacing and separator in log when using "--preserve-env=list" Resolves: RHEL-71916 - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100020 - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls Resolves: RHEL-166069 - Request to backport support for regex in sudo [rhel-9] Resolves: RHEL-1376 - Rebase of sudo to 1.9.17p2 [rhel-9] Resolves: RHEL-128623 - sudo passes SHELL environment variable twice to the shell being executed [rhel-9] Resolves: RHEL-127359 RHEL: 9.7.0 ERRATUM - sudo missing spacing and separator in log when using "--preserve-env=list" Resolves: RHEL-71916 - CVE-2025-32462 sudo: LPE via host option Resolves: RHEL-100020 - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Disable lazy binding (#2044892) - Remove RPATH (#2056604) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - drop metis Resolves: #1977815 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - https://fedoraproject.org/wiki/Changes/FlexiBLAS_as_BLAS/LAPACK_manager - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + switcheroo-control-2.4-1 - Update to 2.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + switcheroo-control-2.2-1 - Update to 2.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + switcheroo-control-2.1-1 - Update to 2.1 - Fix crasher on startup (#1786846) + switcheroo-control-2.0-2 - Fix post scripts not reloading service file + switcheroo-control-2.0-1 - Update to 2.0 - Fix SHA-1 algorithm availability Resolves: RHEL-46788 - Update to v0.8.0 release Resolves: rhbz#2092944 - Fix SHA-1 algorithm availability Resolves: RHEL-46788 - Update to v0.8.0 release Resolves: rhbz#2092944 - Bump release number - Resolves: #RHEL-96214 - isohybrid: Make GPT GUIDs reproducible with --uefi and --id - Resolves: #RHEL-96214 - Bump release number - Resolves: #RHEL-96214 - isohybrid: Make GPT GUIDs reproducible with --uefi and --id - Resolves: #RHEL-96214 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Add explicit conflicts to help with upgrades - Update to 3.39.94 - Split sysprof-capture library and header files out to sysprof-capture-devel - Update minimum required glib2 version - Update to 3.39.92 - Specify pic for static libsysprof-capture - Update to 3.39.90 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Add explicit conflicts to help with upgrades - Update to 3.39.94 - Split sysprof-capture library and header files out to sysprof-capture-devel - Update minimum required glib2 version - Update to 3.39.92 - Specify pic for static libsysprof-capture - Update to 3.39.90 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.40.1 - Update to 3.40.0 - Add explicit conflicts to help with upgrades - Update to 3.39.94 - Split sysprof-capture library and header files out to sysprof-capture-devel - Update minimum required glib2 version - Update to 3.39.92 - Specify pic for static libsysprof-capture - Update to 3.39.90 - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - Fix race condition in io/tst-stat symlink test (RHEL-142209) - Restore iconv tool verbosity for unrecognized encoding names (RHEL-1018) - Optimize trylock for high cache contention workloads. (RHEL-141072) - Update locales for Croatia to use EUR as currency symbol (RHEL-140105) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-54450) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142196) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - Add LD_DEBUG=tls support for tracking TLS and TCB events (RHEL-49785) - Avoid duplicate DNS query if search list contains '.' (RHEL-153056) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - Fix null pointer dereference and assertion failures in __nss_database_get (bug 28940) (RHEL-150269) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180340) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172710) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-145156) - Fix incorrect setting of CXX variable in spec file (RHEL-148252) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168096) - resolv: Correctly count records and check hostname validity (RHEL-168851, RHEL-168852) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162901) - Fix namespace violation in fortify wrappers (bug 32052) (RHEL-52966) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248058) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249636) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251524) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247963) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253645) - Fail the build if there are unexpected test failures (RHEL-252939) - Adjust support/tst-support_descriptors for running under Konflux (RHEL-252863) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238488) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238478) - Stop shipping glibc32-debuginfo (RHEL-219516) - iconv: Suppress intermediate errors with //TRANSLIT (RHEL-178279) - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-180336, RHEL-185614) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Debrand for AlmaLinux - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558) - timer: rebase last_trigger timestamp if needed (RHEL-118215) - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215) - strv: introduce string_strv_hashmap_remove() (RHEL-14112) - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112) - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112) - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112) - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801) - Debrand for AlmaLinux - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - core: fix array size in unit_log_resources() (RHEL-131338) - pid1: add env var to override default mount rate limit burst (RHEL-129153) - pid1: add env var to override default mount rate limit interval (RHEL-129153) - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859) - cryptsetup-generator: continue parsing after error (RHEL-127859) - cryptsetup-generator: parse all cmdline devices too (RHEL-127859) - cryptsetup-generator: always process cmdline devices (RHEL-127859) - logind: add "background-light" session class (RHEL-109833) - pam_systemd: honor session class provided via PAM environment (RHEL-109833) - Debrand for AlmaLinux - test: rename the start limit subtest (RHEL-212086) - ci: install GPG keys for Fedora 42 (RHEL-212086) - core: increment start limit counter only when we can start the unit (RHEL-212086) - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-212086) - test: extend start limit interval (RHEL-212086) - ci: bump the mkosi job to Ubuntu Noble (RHEL-212086) - ci: bump super-linter to v8.7.0 (RHEL-212086) - ci: explicitly disable multi status for Super-Linter (RHEL-212086) - github/linter: disable ENABLE_GITHUB_PULL_REQUEST_SUMMARY_COMMENT for super-linter (RHEL-212086) - test: install iscsi-gen-initiatorname from iscsi-initiator-utils (RHEL-212086) - fstab-generator: support swap on network block devices (RHEL-166186) - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870) - nspawn: normalize pivot_root paths (RHEL-163870) - udev: check for invalid chars in various fields received from the kernel (RHEL-163876) - udev: fix review mixup (RHEL-163876) - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876) - core: validate input cgroup path more prudently (RHEL-152082) - manager: fix scope for environment generators (RHEL-154262) - core: only activate transaction that contain useful jobs (RHEL-143727) - core/service: fix error cause in the log (RHEL-138414) - fstab-generator: drop assertions for mount opts (RHEL-92752) - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752) - core: reorder systemd arguments on reexec (RHEL-111135) - basic: add RuntimeScope enum (RHEL-137252) - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252) - sd-path: add support for XDG_STATE_HOME (RHEL-137252) - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252) - path tool: add some basic ansi highlighing (RHEL-137252) - execude: include RuntimeScope field in ExecParameters (RHEL-137252) - execute: remove redundant assignment (RHEL-137252) - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252) - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252) - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252) - execute: shorten some code by using RET_NERRNO() (RHEL-137252) - execute: shorten code by making use of laccess() return code properly (RHEL-137252) - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252) - test: add test for new XDG_STATE_HOME handling (RHEL-137252) - man: mention the newly-added XDG_STATE_HOME (RHEL-137252) - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252) - man: properly close XML tags (RHEL-137252) - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252) - test: use XDG_STATE_HOME for %S and %L (RHEL-137252) - man: fully adopt ~/.local/state/ (RHEL-137252) - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622) - Fix RHEL-132676 - Fix RHEL-130244 - Backport upstream patch 53c48b550 imply kernel<vmlinux.h> check by file name. - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-90805: Update dev.stp tapset to handle RHEL-9.7 kernels. - RHEL-RHEL-89809: stap-server log owned by root - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-67586: supply /usr/bin/dtrace in sdt-devel subrpm too - Upstream release, see wiki page below for detailed notes. - https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-50107.patch: Make systemtap compatible with kernel commit 68cbd415dd4b . Related: RHEL-56962 . - Fix RHEL-132676 - Fix RHEL-130244 - Backport upstream patch 53c48b550 imply kernel<vmlinux.h> check by file name. - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-90805: Update dev.stp tapset to handle RHEL-9.7 kernels. - RHEL-RHEL-89809: stap-server log owned by root - Upstream release, see wiki page below for detailed notes. https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-67586: supply /usr/bin/dtrace in sdt-devel subrpm too - Upstream release, see wiki page below for detailed notes. - https://sourceware.org/systemtap/wiki/SystemTapReleases - RHEL-50107.patch: Make systemtap compatible with kernel commit 68cbd415dd4b . Related: RHEL-56962 . - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Fixed brlapi multilib Resolves: rhbz#1915335 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - New version Resolves: rhbz#1910328 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fixed brlapi.key to pass the RPM verification - OCaml 4.11.1 rebuild - OCaml 4.11.0 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Dropped explicit brlapi dependency (brltty) and relaxed brltty dependency (brlapi) Related: rhbz#1765611 - fix the Requires package name for teamd-devel - teamd: stop iterating callbacks when a loop restart is requested (rhbz#2148852) - teamd: do no remove the ports on shutdown with -N (rhbz#2148854) - Rebuilt with a new version to pass the fixed gating test (rhbz#2060445) - utils/team2bond: do not add updelay/downdelay if already exist (rhbz#2060445) - utils/team2bond: do not add miimon if already exist (rhbz#2060445) - Revert "teamd: Disregard current state when considering port enablement" [1894546] - Remove an extra line in spec file - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Build util team2bond in teamd rpm [1986788] - Add some cautions to util team2bond [1986788] - Add team2bond man doc [1986788] - gating: fix the wrong link of openvswitch for RHEL-9 [1970175] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Second attempt - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Modernize spec file - License corrected to ((LGPLv2+ or CPL) and (LGPLv2+ or GPLv2+ or MPLv2.0 or MPLv1.1)) - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for inclusion of new subpackages - Resolves: RHEL-113420 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild for ICU 67 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 4.1.1 - Rebuild for ICU 65 - Resolves: CVE-2026-73066 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 7.2.0~SNAPSHOT - Update to upstream version 7.1.1 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 7.2.0~SNAPSHOT - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 7.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Port to Google Guice 5 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 7.2.0~SNAPSHOT - Update to upstream version 7.1.1 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Update to upstream version 7.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 7.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to upstream version 7.2.0~SNAPSHOT - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 7.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Port to Google Guice 5 - Resolves: #2209872, CVE-2023-32700 - Resolves: #2031879, fix invalid symlink to mktexmf - Related: #2014453, fixed dependencies - Resolves: #2014453, runtime requirement on python-unversioned-command - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: #1960650, updated create-clean-texlive.sh, dropped ps2pk - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs - Related: #1960650 - fixed license tags and rpath issue - Resolves: #2209872, CVE-2023-32700 - Resolves: #2031879, fix invalid symlink to mktexmf - Related: #2014453, fixed dependencies - Resolves: #2014453, runtime requirement on python-unversioned-command - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: #1960650, updated create-clean-texlive.sh, dropped ps2pk - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs - Related: #1960650 - fixed license tags and rpath issue - Resolves: #2209872, CVE-2023-32700 - Resolves: #2031879, fix invalid symlink to mktexmf - Related: #2014453, fixed dependencies - Resolves: #2014453, runtime requirement on python-unversioned-command - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: #1960650, updated create-clean-texlive.sh, dropped ps2pk - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs - Related: #1960650 - fixed license tags and rpath issue - Resolves: #2209872, CVE-2023-32700 - Resolves: #2031879, fix invalid symlink to mktexmf - Related: #2014453, fixed dependencies - Resolves: #2014453, runtime requirement on python-unversioned-command - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: #1960650, updated create-clean-texlive.sh, dropped ps2pk - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs - Related: #1960650 - fixed license tags and rpath issue - Resolves: #2209872, CVE-2023-32700 - Resolves: #2031879, fix invalid symlink to mktexmf - Related: #2014453, fixed dependencies - Resolves: #2014453, runtime requirement on python-unversioned-command - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: #1960650, updated create-clean-texlive.sh, dropped ps2pk - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs - Related: #1960650 - fixed license tags and rpath issue - Resolves: #2209872, CVE-2023-32700 - Resolves: #2031879, fix invalid symlink to mktexmf - Related: #2014453, fixed dependencies - Resolves: #2014453, runtime requirement on python-unversioned-command - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Related: #1960650, updated create-clean-texlive.sh, dropped ps2pk - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs - Related: #1960650 - fixed license tags and rpath issue - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - New upstream release. Resolves: rhbz#1254352 - Sub-package texttopaps with old code. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to 0.7.2 - Switch to use OpenType Font Format - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Use make macros, patch by Tom Stellard <tstellar@redhat.com> - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix multilib issue with systemd-sysusers config Related: RHEL-90737 - Add support for post-quantum cryptography Resolves: RHEL-127514 - Use systemd-sysusers for the 'pegasus' user and group creation - Fix Requires of subpackages Related: RHEL-90737 - Add support for Image Mode Resolves: RHEL-90737 - Update OpenSSL certificates set up Resolves: RHEL-81721 - Remove deprecated path from systemd service file Resolves: RHEL-81716 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Related: #2184133 Declare file conflicts - Resolves: #2184133 Fix bug in Obsoletes - Resolves: #2210632 CVE-2023-28709 tomcat - Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3 - Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3 - Resolves: #2173872 Remove java-11-openjdk-headles as a tomcat dependency - Resolves: #2181461 CVE-2023-28708 tomcat: not including the secure attribute causes information - Resolves: #2210632 CVE-2023-28709 - Resolves: #2184133 Add Obsoletes to tomcat package - Update patch command - Update source to use jws tomcat - Bump release so that the NVR on RHEL-9 is higher than RHEL-8 - Bump release to run the tier1 test - Add conflicts declaration to the appropriate subpackages - Fix malformed DTD file that caused problems with rpminspect - Add conflicts with the pki-servlet-engine package - Update to 9.0.62. Related: rhbz#2160511 - Remove examples webapps from subpackage - Remove maven artifacts from build as they aren't very useful - Drop JSVC support as it's not very useful these days - Drop geronimo-saaj as it's no longer required - Drop geronimo-jaxrpc, which provided the webservices naming factory resources that are generally unused - Cleaning up some unused deps and system properties - Add Java 9 start-up parameters to allow reflection - Add bnd-annotation which is in bndlib - Add fixes for memory leak which have been fixed in 9.0.64 - Related: #2184133 Declare file conflicts - Resolves: #2184133 Fix bug in Obsoletes - Resolves: #2210632 CVE-2023-28709 tomcat - Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3 - Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3 - Resolves: #2173872 Remove java-11-openjdk-headles as a tomcat dependency - Resolves: #2181461 CVE-2023-28708 tomcat: not including the secure attribute causes information - Resolves: #2210632 CVE-2023-28709 - Resolves: #2184133 Add Obsoletes to tomcat package - Update patch command - Update source to use jws tomcat - Bump release so that the NVR on RHEL-9 is higher than RHEL-8 - Bump release to run the tier1 test - Add conflicts declaration to the appropriate subpackages - Fix malformed DTD file that caused problems with rpminspect - Add conflicts with the pki-servlet-engine package - Update to 9.0.62. Related: rhbz#2160511 - Remove examples webapps from subpackage - Remove maven artifacts from build as they aren't very useful - Drop JSVC support as it's not very useful these days - Drop geronimo-saaj as it's no longer required - Drop geronimo-jaxrpc, which provided the webservices naming factory resources that are generally unused - Cleaning up some unused deps and system properties - Add Java 9 start-up parameters to allow reflection - Add bnd-annotation which is in bndlib - Add fixes for memory leak which have been fixed in 9.0.64 - Related: #2184133 Declare file conflicts - Resolves: #2184133 Fix bug in Obsoletes - Resolves: #2210632 CVE-2023-28709 tomcat - Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3 - Resolves: #2189675 Missing Tomcat POM files in RHEL 9.3 - Resolves: #2173872 Remove java-11-openjdk-headles as a tomcat dependency - Resolves: #2181461 CVE-2023-28708 tomcat: not including the secure attribute causes information - Resolves: #2210632 CVE-2023-28709 - Resolves: #2184133 Add Obsoletes to tomcat package - Update patch command - Update source to use jws tomcat - Bump release so that the NVR on RHEL-9 is higher than RHEL-8 - Bump release to run the tier1 test - Add conflicts declaration to the appropriate subpackages - Fix malformed DTD file that caused problems with rpminspect - Add conflicts with the pki-servlet-engine package - Update to 9.0.62. Related: rhbz#2160511 - Remove examples webapps from subpackage - Remove maven artifacts from build as they aren't very useful - Drop JSVC support as it's not very useful these days - Drop geronimo-saaj as it's no longer required - Drop geronimo-jaxrpc, which provided the webservices naming factory resources that are generally unused - Cleaning up some unused deps and system properties - Add Java 9 start-up parameters to allow reflection - Add bnd-annotation which is in bndlib - Add fixes for memory leak which have been fixed in 9.0.64 - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes - Resolves: rhbz#1949422 + totem-3.38.2-1 - Update to 3.38.2 - Resolves: rhbz#2014992 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + totem-3.38.1-1 - Update to 3.38.1 - Resolves: rhbz#1972740 - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes - Resolves: rhbz#1949422 + totem-3.38.2-1 - Update to 3.38.2 - Resolves: rhbz#2014992 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + totem-3.38.1-1 - Update to 3.38.1 - Resolves: rhbz#1972740 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + totem-pl-parser-3.26.6-1 - Update to 3.26.6 - Resolves: rhbz#1976722 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + totem-pl-parser-3.26.5-3 - Disable quvi, upstream is dead, and it doesn't compile with lua 5.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + totem-pl-parser-3.26.5-1 - Update to 3.26.5 + totem-pl-parser-3.26.4-3 - Disable quvi support on RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + totem-pl-parser-3.26.4-1 - Update to 3.26.4 - Use conflicts for totem-video-thumbnailer split instead of self-obsoletes - Resolves: rhbz#1949422 + totem-3.38.2-1 - Update to 3.38.2 - Resolves: rhbz#2014992 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 + totem-3.38.1-1 - Update to 3.38.1 - Resolves: rhbz#1972740 - Fix trace messages (RHEL-86597) - Rebuild without side-tags (RHEL-76155) - Rebase to version 3.3.1 (RHEL-76155) - Backport module-based libsoup support Resolves: rhbz#2137366 - Ship tracker-devel in CRB - Update to 3.1.2 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 3.1.1 - Update to 3.1.0 - Obsolete libtracker-control and libtracker-miner - Add conflicts with tracker3 packages to help with the upgrade path - Update to 3.1.0.rc, based on earlier tracker3 packaging - Obsolete separate tracker3 packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - new release - rebased tuned to latest upstream related: RHEL-50568 - clear plugin repository when stopping tuning - man: add description of the balanced-battery profile - net: added more coalescing options, filter out unsupported ones resolves: RHEL-181668 - new release - rebased tuned to latest upstream related: RHEL-123607 - new release - rebased tuned to latest upstream resolves: RHEL-123607 - cpu-partitioning: autodetect dracut hook directory, systemd workaround - openshift: optimize TCP settings for high throughput and low latency - profiles: Set boost=1 in *-performance profiles - sap-hana: force latency to 70 us, not to C-states - man: fixed instance_acquire_devices example in tuned-adm man - spec: use correct python interpreter for documentation installation - sysctl: add reapply_sysctl_exclude option - ppd: ask tuned recommend for base profile - new release - rebased tuned to latest upstream related: RHEL-94808 - new release - rebased tuned to latest upstream resolves: RHEL-94808 - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor - tuned-ppd: enabled sysfs_acpi_monitor by default - tuned-ppd: fixed inotify watch for performance degradation - tuned-ppd: pinned virtual files in memory for inotify - fixed instance priority inheritance - hotplug: added fixes for device remove race condition - tuned-main.conf: added startup_udev_settle_wait option - functions: silenced errors if module kvm_intel does not exist resolves: RHEL-79943 - functions: make calc_isolated_cores return CPU ranges resolves: RHEL-75751 - scsi: used 'med_power_with_dipm' for SATA ALPM - scsi: do not set ALPM on external SATA ports - network_latency: Set non-zero rcutree.nohz_full_patience_delay - realtime: Disable appropriate P-State drivers resolves: RHEL-85637 - plugin_disk: added support for MMC (MultiMediaCard) devices - udev: fix possible traceback in device matcher - udev-settle: obey udev buffer size and handle possible tracebacks - daemon: re-raise daemon init exception in no-daemon mode resolves: RHEL-71304 - vm: deprecate dirty_ratio in favour of dirty_bytes with percents resolves: RHEL-101578 - gui: fix the profile deleter script - Fix handling of kernel arguments on bootc systems resolves: RHEL-45836 resolves: RHEL-86814 - new release - rebased tuned to latest upstream related: RHEL-70457 - plugins: added missing instance parameters - disk: added missing remove parameter - plugin_scheduler: added switch to disable processing of kthreads - Makefile: added support for installation to custom LIBEXECDIR - functions: create a new parser object for each string expansion resolves: RHEL-75773 - new release - rebased tuned to latest upstream related: RHEL-70457 - sap-hana: Set transparent_hugepages to madvise - plugin_bootloader: export Grub variables to make them available in submenus - utils.commands: fixed CPU online detection when not present - plugin_net: handled cqe-mode-rx ethtool option - profiles: correct CPU governor settings - new release - rebased tuned to latest upstream resolves: RHEL-70457 - tuned-ppd: removed the use of StrEnum - tuned-ppd: fixed traceback - tuned-ppd: multiple fixes and updates - docs: plugins docs are now automatically generated from the docstrings - plugin_cpu: fixed no_turbo boolean option parsing resolves: RHEL-51760 - plugin_cpu: allowed raw energy_performance_preference values - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters resolves: RHEL-58820 - plugin_bootloader: added variables to BLS entries only if grub is used - plugin_scheduler: do not assume that perf events have type attribute - plugin_scheduler: updated sched knobs for kernels 6.6+ - plugin_scheduler: log process info when its affinity cannot be changed - plugin_scheduler: postpone cgroup blacklist check, double-check after fail resolves: RHEL-72981 - plugin_scheduler: made perf support optional - plugin_net: added support for hotplug and rename resolves: RHEL-60906 - makefile: added support for installation to custom $BINDIR/$SBINDIR - functions: dropped cpuspeed support - Fixed privileged execution of arbitrary scripts by active local user, (CVE-2024-52336) Resolves: RHEL-66638 - Added sanity checks for API methods parameters, (CVE-2024-52337) Resolves: RHEL-66615 - Fix invalid SPDX expression in license tag - Update to 2.43.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 2.42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Backport fix for Backport fix for https://sourceware.org/bugzilla/show_bug.cgi?id=30079 - Backport fix for CVE-2023-1972 - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Pass --with-default-msvcrt=msvcrt when building mingw32/64 crt - Add libbcryptprimitives.dll Related: https://bugzilla.redhat.com/show_bug.cgi?id=2299374 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 12.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix meson deprecation warnings - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rust fixes - Set __debug_package 1 in %mingw_debug_package (#2284193) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add pkgconfig provides - Add dependency on cmake-rpm-macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Set mingw_env before in run_mingw_make - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Pass --with-default-msvcrt=msvcrt when building mingw32/64-headers - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 12.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild on fixed mingw-crt - Rebuild for fixed default msvcrt in mingw-crt - Update to 14.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 20240701 snapshot - Update to 20240607 snapshot - Build GCC with plugin support - Update to 14.1.1 - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for fixed mingw-crt - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 12.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild for fixed mingw-crt - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 12.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Build UCRT64 package - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Build UCRT64 package - Update to 1.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves:rhbz#1962002 - Add gating tests - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Resolves: rhbz#1933581 - Don't BuildRequires xorg-x11-font-utils - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt with fonttosfnt 1.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Provide OpenType Bitmap fonts - Add ucs-miscfixed-opentype-fonts sub package - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for RHEL-9.8 - Resolves: RHEL-98268 - Update to upstream release 1.19.1 - Resolves: RHEL-98268 - bump release to rebuild in sidetag - Resolves: RHEL-98268 - Update to upstream release 1.19.0 - Resolves: RHEL-98268 - Update to upstream release 1.18.1 - Resolves: RHEL-94447 - Fix build for ppc64le - Resolves: RHEL-52883 - Update to upstream release 1.17.0 - Resolves: RHEL-52883 - Update to upstream release 1.16.0 - Resolves: RHEL-24468, RHEL-31249 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - preload: Wrap fstatfs(), to work with systemd 251 also with Python tests - Fix tests in Gentoo sandbox build - Work around packit propose_downstream bug - Adjust to systemd 251-rc2: Set $SYSTEMD_DEVICE_VERIFY_SYSFS, parse new udevadm format, update tests - preload: Wrap fortified version of readlinkat (thanks Martin Liska) - Fix some potential crashes spotted by Coverity - Enable Fedora builds and bodhi updates via packit - Fix uevent race condition in umockdev_testbed_add_from_string() - Increase uevent buffer size (#167) - Skip /umockdev-testbed-vala/detects_running_outside_testbed during normal builds for the time being, as it is brittle on several architectures (#169) - Relax overzealous stat nlink unit test - preload: Wrap statx() and fstatat(), to fix `ls` and other tools on recent glibc versions. (#160) - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - preload: Wrap fstatfs(), to work with systemd 251 also with Python tests - Fix tests in Gentoo sandbox build - Work around packit propose_downstream bug - Adjust to systemd 251-rc2: Set $SYSTEMD_DEVICE_VERIFY_SYSFS, parse new udevadm format, update tests - preload: Wrap fortified version of readlinkat (thanks Martin Liska) - Fix some potential crashes spotted by Coverity - Enable Fedora builds and bodhi updates via packit - Fix uevent race condition in umockdev_testbed_add_from_string() - Increase uevent buffer size (#167) - Skip /umockdev-testbed-vala/detects_running_outside_testbed during normal builds for the time being, as it is brittle on several architectures (#169) - Relax overzealous stat nlink unit test - preload: Wrap statx() and fstatat(), to fix `ls` and other tools on recent glibc versions. (#160) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update to Unicode Emoji Data 13.0 (was released on January 29, 2020) - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix build with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 2.9.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.9.1 - Update to upstream version 2.9.0 - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Fix build with OpenJDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Update to version 2.9.1. - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.9.1 - Update to upstream version 2.9.0 - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Require mkfontscale and mkfontdir directly (#1937125) - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fix some X11-related packaging bugs (#1918947) - Rebase to 20200910 version (#1877974) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - do not mention specific OS in description - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - restore permissions of usbguard files Resolves: RHEL-126440 - rebase to 1.1.4 - restore permissions of usbguard files Resolves: RHEL-126440 - Install usbguard-tmpfles.conf Resolves: RHEL-78188 - fix build flags (#2044896) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to pick up new build flags from redhat-rpm-config (#1984652) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Specify all perl dependencies - fix build flags (#2044896) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to pick up new build flags from redhat-rpm-config (#1984652) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Specify all perl dependencies - fix build flags (#2044896) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to pick up new build flags from redhat-rpm-config (#1984652) - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Perl 5.32 rebuild - Specify all perl dependencies - Rebuilt for CRB inclusion Resolves: RHEL-135108 - Actually apply the patch for CVE-2024-27982 - Backport patch for CVE-2024-27982 - Use system OpenSSL configuration section - Backport patches for several CVEs. Fixes CVE-2024-22025 CVE-2024-25629 CVE-2024-27983 CVE-2024-28182 - Fix CVE-2024-22019 - Update version of bundled nghttp2 in spec file - Update bundled nghttp2 to 1.57.0 (CVE-2023-44487) - Rebase to 16.20.2 Resolves: CVE-2023-32002 CVE-2023-32006 CVE-2023-32559 - Fix segfault that happens when processing fips-related options Resolves: BZ#2227796 - Rebase to 16.20.1 Resolves: rhbz#2188291 Resolves: CVE-2023-30581 CVE-2023-30588 CVE-2023-30589 CVE-2023-30590 - Replace /usr/etc/npmrc symlink with builtin configuration Resolves: rhbz#2177781 - Update to 0.48.19 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.48.17 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.48.15 - Update to 0.48.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.48.13 - Fix multilib conflicts in vala-gen-introspect - Update to 0.48.12 - Update to 0.48.19 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.48.17 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.48.15 - Update to 0.48.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.48.13 - Fix multilib conflicts in vala-gen-introspect - Update to 0.48.12 - Update to 0.48.19 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Update to 0.48.17 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 0.48.15 - Update to 0.48.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 0.48.13 - Fix multilib conflicts in vala-gen-introspect - Update to 0.48.12 - Rebase to 8.0.10 for CVE-2026-56684 CVE-2026-63639 (CVE-2026-66373 in redis) - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631 - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - fix ImageMode: ensure ownership of /etc/valkey - fix ImageMode: add tmpfiles.d entries for directories below /var - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023 - rebase to 8.0.3 - rebase to 8.0.2 Resolves: RHEL-73273 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - fix ImageMode: ensure ownership of /etc/valkey - fix ImageMode: add tmpfiles.d entries for directories below /var - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023 - rebase to 8.0.3 - rebase to 8.0.2 Resolves: RHEL-73273 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase to 7.2.6 - merge limit.conf in main service files - drop /etc/sysconfig/valkey - rename compat package - fix working dir - partially enable upstream test suite - Bump release for June 2024 mass rebuild - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631 - Rebase to 8.0.7 for CVE-2026-21863 CVE-2025-67733 - rebase to 8.0.6 for CVE-2025-49844 CVE-2025-46817 CVE-2025-46818 CVE-2025-46819 - fix ImageMode: ensure ownership of /etc/valkey - fix ImageMode: add tmpfiles.d entries for directories below /var - rebase to 8.0.4 for CVE-2025-27151 CVE-2025-48367 and CVE-2025-32023 - rebase to 8.0.3 - rebase to 8.0.2 Resolves: RHEL-73273 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebase to 7.2.6 - merge limit.conf in main service files - drop /etc/sysconfig/valkey - rename compat package - fix working dir - partially enable upstream test suite - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Default to JDK logging and drop commons-logging and log4j12 implementations. - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Default to JDK logging and drop commons-logging and log4j12 implementations. - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Ignore test case that fails on Java 11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Default to JDK logging and drop commons-logging and log4j12 implementations. - Port to commons-lang3. - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Switch to a newer patch macro syntax - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove cache=none resolves: RHEL-135832 - Fix pnputil driver store after conversion resolves: RHEL-128776 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-125120 - mlcustomize: Remove dnf --verbose option resolves: RHEL-83289 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85512 - Print nbdcopy command in debug output resolves: RHEL-86022 - Turn live domain error into a warning resolves: RHEL-88543 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88857 - Print better mountpoint stats in debug output resolves: RHEL-88861 - Remove several ancient, deprecated options resolves: RHEL-88866 - New tool: virt-v2v-open resolves: RHEL-88985 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102618 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-100682 - Rebase to upstream development version 2.7.1 resolves: RHEL-56813 - Replace Jansson with json-c resolves: RHEL-65296 - Find drivers for win2025 guests resolves: RHEL-65010 - in-place: Add new -O option to write inspector XML resolves: RHEL-58032 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-77989 - convert: Use yum/apt/... for package removals resolves: RHEL-71522 - Fix failure if the kernel-source package is installed in the source VM resolves: RHEL-80080 - Rebase to upstream development version 2.5.9 - Fix display of incorrect Windows 11 version resolves: RHEL-56784 - Add customization options for post-conversion modification resolves: RHEL-55761 - convert: windows: Ignore sriov drivers on virtio-win disk resolves: RHEL-56383 - convert: windows: Online all virtio disks at first boot resolves: RHEL-55763 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-49761, RHEL-51169 - Document uninstallation of VMware Tools on Windows resolves: RHEL-51169 - Further fixes for QEMU Guest Agent resolves: RHEL-49761 - Place Windows firstboot files under C:\Program Files\Guestfs\Firstboot - Improve debugging output - Remove cache=none resolves: RHEL-135832 - Fix pnputil driver store after conversion resolves: RHEL-128776 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-125120 - mlcustomize: Remove dnf --verbose option resolves: RHEL-83289 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85512 - Print nbdcopy command in debug output resolves: RHEL-86022 - Turn live domain error into a warning resolves: RHEL-88543 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88857 - Print better mountpoint stats in debug output resolves: RHEL-88861 - Remove several ancient, deprecated options resolves: RHEL-88866 - New tool: virt-v2v-open resolves: RHEL-88985 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102618 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-100682 - Rebase to upstream development version 2.7.1 resolves: RHEL-56813 - Replace Jansson with json-c resolves: RHEL-65296 - Find drivers for win2025 guests resolves: RHEL-65010 - in-place: Add new -O option to write inspector XML resolves: RHEL-58032 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-77989 - convert: Use yum/apt/... for package removals resolves: RHEL-71522 - Fix failure if the kernel-source package is installed in the source VM resolves: RHEL-80080 - Rebase to upstream development version 2.5.9 - Fix display of incorrect Windows 11 version resolves: RHEL-56784 - Add customization options for post-conversion modification resolves: RHEL-55761 - convert: windows: Ignore sriov drivers on virtio-win disk resolves: RHEL-56383 - convert: windows: Online all virtio disks at first boot resolves: RHEL-55763 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-49761, RHEL-51169 - Document uninstallation of VMware Tools on Windows resolves: RHEL-51169 - Further fixes for QEMU Guest Agent resolves: RHEL-49761 - Place Windows firstboot files under C:\Program Files\Guestfs\Firstboot - Improve debugging output - Remove cache=none resolves: RHEL-135832 - Fix pnputil driver store after conversion resolves: RHEL-128776 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-125120 - mlcustomize: Remove dnf --verbose option resolves: RHEL-83289 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85512 - Print nbdcopy command in debug output resolves: RHEL-86022 - Turn live domain error into a warning resolves: RHEL-88543 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88857 - Print better mountpoint stats in debug output resolves: RHEL-88861 - Remove several ancient, deprecated options resolves: RHEL-88866 - New tool: virt-v2v-open resolves: RHEL-88985 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102618 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-100682 - Rebase to upstream development version 2.7.1 resolves: RHEL-56813 - Replace Jansson with json-c resolves: RHEL-65296 - Find drivers for win2025 guests resolves: RHEL-65010 - in-place: Add new -O option to write inspector XML resolves: RHEL-58032 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-77989 - convert: Use yum/apt/... for package removals resolves: RHEL-71522 - Fix failure if the kernel-source package is installed in the source VM resolves: RHEL-80080 - Rebase to upstream development version 2.5.9 - Fix display of incorrect Windows 11 version resolves: RHEL-56784 - Add customization options for post-conversion modification resolves: RHEL-55761 - convert: windows: Ignore sriov drivers on virtio-win disk resolves: RHEL-56383 - convert: windows: Online all virtio disks at first boot resolves: RHEL-55763 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-49761, RHEL-51169 - Document uninstallation of VMware Tools on Windows resolves: RHEL-51169 - Further fixes for QEMU Guest Agent resolves: RHEL-49761 - Place Windows firstboot files under C:\Program Files\Guestfs\Firstboot - Improve debugging output - Updated to upstream version 1.2 plus latest fixes resolves: RHEL-148557 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Resolves: rhbz#1977691 bump release number to add libvoikko-devel package to CRB - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Add Requires: voikko-fi - The dictionary data directory will now be /usr/lib/voikko on all architectures - Create and own /usr/lib/voikko, so different dictionary packages can own the subdirectories there - This was suggested in the review of the voikko-fi package, see rhbz#1919688 - Use the license macro - Bump release for a new Copr build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to 4.3 - Add GPG signature check for the source - Fix pycached stuff - Remove old python_provide macro - Remove ldconfig_scriptlets macro - Only use VFST for now, HFST can be provided in a later update - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for Python 3.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Update to 1.21.0 Resolves: rhbz#2063522 - Rebuilt for libffi 3.4.2 SONAME transition. Related: rhbz#1891914 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Update to 1.19.0 - Switch to meson build system - Drop old provides - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Bump release for y-stream AND z-stream building using centpkg build --rhel-target=zstream Related: RHEL-89344 - tests: OSTree does not support the qcow2 image type - Add test repositories for RHEL 9.6 and 9.7 - Rebuild for CVE-2025-22871 Resolves: RHEL-89344 - Add centos 9 repos for testing Related: RHEL-1035 - Copy rhel-9.4.json test repository from osbuild-composer - New release: 35.12 (bcl) Resolves: RHEL-1035 - Add support for compose start warning messages (bcl) - Update documentation urls for new locations (bcl) - weldr: go fmt changes to a couple comments (bcl) - weldr: Update ostree test for parentid with no url (bcl) - Makefile: Turn off seccomp for build-in-podman (bcl) - composer-cli: Update doc links (simon.steinbeiss) - docs: fix typo/formatting in HACKING.md (idiez) - Add release creation documentation (bcl) - spec: Require createrepo_c for weldr-client-tests package (bcl) - spec: migrate the license field to SPDX (ondrej) - Go: Switch to go 1.19 (bcl) - CI: Update terraform hash (bcl) - Actions: add workflow for marking and closing stale issues and PRs (thozza) - workflows: Stop using golint (bcl) - workflows: Add Go 1.21 and 1.22 to test matrix (bcl) - workflows: Update to golangci-lint 1.56.2 (bcl) - workflow: Ignore govulncheck failures (bcl) - workflow: Switch to testing on go 1.18, 1.19, 1.20 (bcl) - build(deps): bump actions/setup-go from 3 to 5 (49699333+dependabot[bot]) - build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.8.0 (49699333+dependabot[bot]) - build(deps): bump actions/checkout from 3 to 4 (49699333+dependabot[bot]) - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 (49699333+dependabot[bot]) - build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 (49699333+dependabot[bot]) - Update to version 0.5.12 Resolves: RHEL-123624 - Update to version 0.5.10 Resolves: DESKTOP-2313 - Update to version 0.5.12 Resolves: RHEL-123624 - Update to version 0.5.10 Resolves: DESKTOP-2313 - Fix 9.1.0 FTBFS - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Add Coverity Scan fixes patch - Get rid of all things RPATH - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuild to regenerate auto-requires - Remove proprietary data from source RPM - Resolves: RHEL-40891 - Rebuild to regenerate auto-requires - Remove proprietary data from source RPM - Resolves: RHEL-40891 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Enable xbean-finder - Resolves: rhbz#1969297 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.18 - Switch from log4j 1.2 compat package to log4j 1.2 API shim. - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.18 - Switch from log4j 1.2 compat package to log4j 1.2 API shim. - Update to upsteam version 4.17 - Remove springframework conditionals, the deps are a long time removed from Fedora and this simplifies the spec a bit - Disable unused modules that can't build on JDK 11 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Set explicit Java compiler source/target levels to 1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Enable xbean-finder - Resolves: rhbz#1969297 - Bootstrap build - Non-bootstrap build - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 4.18 - Switch from log4j 1.2 compat package to log4j 1.2 API shim. - Update to 1.12.6 Resolves: RHEL-16451 - Update to 1.12.4 Resolves: #2068448, #2076812 - Update to 1.12.3 Resolves: #2068448, #2069328 - Update to 1.12.2 - Explicit library Requires should be arch-specific Resolves: #2068448 - Rebase to 1.12.1 Resolves: #2051488 - Fix incorrect permissions of xerces-j2-samples.jar - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Fix incorrect permissions of xerces-j2-samples.jar - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Split xkbcomp out from xorg-x11-xkb-utils into its own package (#1895770) - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild with regenerated Requires on Java - Install license files in licensedir instead of docdir - Add noarch to ExclusiveArch - Disable building on i686 - Fix patch usage - Rebuild with regenerated Requires on Java - Rebuild with regenerated Requires on Java - Drop bundled expat and build against libxml2 - Resolves: CVE-2022-25235 - Resolves: CVE-2022-25236 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix HTML injection in Abyss error responses and directory listings - Resolves: CVE-2026-15928 - Fix adopt function the same way as in upstream Related: RHEL-35381 - Fix double free in xmlSecGCryptAsymKeyDataGenerate Related: RHEL-35381 - Add xmlsec1-gnutls dependency on xmlsec1-gcrypt Related: RHEL-35381 - Fix memory leaks found by SAST Resolves: RHEL-35381 - Fix adopt function the same way as in upstream Related: RHEL-35381 - Fix double free in xmlSecGCryptAsymKeyDataGenerate Related: RHEL-35381 - Add xmlsec1-gnutls dependency on xmlsec1-gcrypt Related: RHEL-35381 - Fix memory leaks found by SAST Resolves: RHEL-35381 - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973743 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.2 - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973743 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.2 - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973743 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.2 - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973743 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.2 - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973743 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.2 - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update javapackages test plan to f42 - Update to upstream version 2.10.0 - Resolves: rhbz#2277615 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to upstream version 2.9.1 - bump of release for for java-21-openjdk as system jdk - Rebuilt for java-21-openjdk as system jdk - bump of release for for java-21-openjdk as system jdk - Update Java source/target to 1.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Clean tarball from content with questionable licensing - Resolves: rhbz#1973743 - Rebuild to workaround DistroBaker issue - Bootstrap Maven for CentOS Stream 9 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Update to upstream version 2.8.2 - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Disable more tests that require network access - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Clean tarball from content with questionable licensing - Resolves: rhbz#1973721 - Bootstrap build - Non-bootstrap build - Update previous patch to use improved version that was merged upstream - Fix FTBFS by patching ValueAssertTest to adjust for changed format of mismatched string exception - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Port to Modello 2.0.0 - Rebuilt for java-17-openjdk as system jdk - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuild for Maven 3.8.4 - For now keep suggesting OpenJDK 11 Maven binding - Workaround build issue with OpenJDK 17 - Suggest OpenJDK 17 as default Maven binding - Rebuild to update libjansi.so symlink - Update to upstream version 4.0.0 - Add bindings for XMvn toolchains - Resolves: RHEL-70855, RHEL-70860 - Related: RHEL-71057 - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Port to Modello 2.0.0 - Rebuilt for java-17-openjdk as system jdk - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuild for Maven 3.8.4 - For now keep suggesting OpenJDK 11 Maven binding - Workaround build issue with OpenJDK 17 - Suggest OpenJDK 17 as default Maven binding - Rebuild to update libjansi.so symlink - Update to upstream version 4.0.0 - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Port to Modello 2.0.0 - Rebuilt for java-17-openjdk as system jdk - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuild for Maven 3.8.4 - For now keep suggesting OpenJDK 11 Maven binding - Workaround build issue with OpenJDK 17 - Suggest OpenJDK 17 as default Maven binding - Rebuild to update libjansi.so symlink - Update to upstream version 4.0.0 - Add bindings for XMvn toolchains - Resolves: RHEL-70855, RHEL-70860 - Related: RHEL-71057 - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Port to Modello 2.0.0 - Rebuilt for java-17-openjdk as system jdk - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuild for Maven 3.8.4 - For now keep suggesting OpenJDK 11 Maven binding - Workaround build issue with OpenJDK 17 - Suggest OpenJDK 17 as default Maven binding - Rebuild to update libjansi.so symlink - Update to upstream version 4.0.0 - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Port to Modello 2.0.0 - Rebuilt for java-17-openjdk as system jdk - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuild for Maven 3.8.4 - For now keep suggesting OpenJDK 11 Maven binding - Workaround build issue with OpenJDK 17 - Suggest OpenJDK 17 as default Maven binding - Rebuild to update libjansi.so symlink - Update to upstream version 4.0.0 - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Port to Modello 2.0.0 - Rebuilt for java-17-openjdk as system jdk - Suggest OpenJDK 17 as default Maven binding - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuild for Maven 3.8.4 - For now keep suggesting OpenJDK 11 Maven binding - Workaround build issue with OpenJDK 17 - Suggest OpenJDK 17 as default Maven binding - Rebuild to update libjansi.so symlink - Update to upstream version 4.0.0 - Update xmvn-minimal Requires - Specify smoke test requirements - Drop explicit requires on javapackages-tools - Add bindings for XMvn toolchains - Remove dependency on which - Update to upstream version 4.3.0 - Resolves: rhbz#2315092 - Port to commons-compress 1.27 - Rebuild for Sisu 0.9.0.M3 - Remove workaround for rpm bug 447156 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Drop bdftopcf, mkfontscale and fonttosfnt, they are in separate packages now (#1932731) - Update to mkfontscale 1.2.1 which obsoletes the separate mkfontdir. - Add OrderWithRequires for freetype to ensure freetype is installed first - Move license files to license tag on file list - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - fonttosfnt 1.2.1 - Add BuildRequires for make - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Set OpenJDK version to 8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuild for new version 1.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Add noarch to ExclusiveArch - Disable building on i686 - Rebuild - Rebuild - Rebuild - Rebuild with regenerated Requires on Java - Use %autosetup -C - Update javapackages test plan to f42 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for java-21-openjdk as system jdk - Set OpenJDK version to 8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Rebuilt for java-17-openjdk as system jdk - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - Bootstrap build - Non-bootstrap build - Rebuild for new version 1.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix arbitrary file write vulnerability Resolves: CVE-2022-1271 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Enabled CET for i686 (#1910368) - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Fix location of German man pages (RHBZ#1844813). - Fix: a buffer overflow in lzma_index_append() - Add test for the issue above (needs a special build config to actually fail -> does not fail in our environment) - Resolves: CVE-2026-34743 - bump to 4.5.2 - remove pcre build dependency - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix CVE-2025-3155 (RHEL-85926) - Initial package (RHEL-29800) - Drop generation of automatic Go source package - Initial package (RHEL-29802) - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fixes for test failures with zstd-1.4.7+ - Add man pages - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix small bug in corner case when handling write failures - Fix download failure when web server doesn't include content-type with each range - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fixes for test failures with zstd-1.4.7+ - Add man pages - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix small bug in corner case when handling write failures - Fix download failure when web server doesn't include content-type with each range - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - Rebuilt for RHEL 9 BETA for openssl 3.0 Related: rhbz#1971065 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Fixes for test failures with zstd-1.4.7+ - Add man pages - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - Fix small bug in corner case when handling write failures - Fix download failure when web server doesn't include content-type with each range - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - do not perform PROMPT_SUBST evaluation on %F/%K arguments (CVE-2021-45444) - Overwrite PROMPT only if it's set to the built-in default (#2026749) - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937 - complete file arguments after rpmbuild -r/-b/-t - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - Use make macros - https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - update to latest upstream release